11{
2+ "0xc9e76a92" : " synctime"
3+ "0x350ee996" : " sqbcoreservice"
4+ "0x45a5f154" : " thunderbird"
25 "0x1f74b2c2" : " GxCIMgr"
3- "0xd3081d00" : " hta"
4- "0xe2cb9b97" : " winword"
5- "0xb7ea3892" : " msocache"
6+ "0xab086595" : " program files (x86)"
7+ "0xdd481cc0" : " msi"
68 "0xc7701a40" : " bin"
7- "0xcd1b589b" : " x64dbg"
8- "0x43b64f11" : " tbirdconfig"
9- "0x3eb272e6" : " explorer.exe"
9+ "0xdf301900" : " ndf"
10+ "0xdb645841" : " mydesktopqos"
11+ "0xd3801b00" : " hlp"
12+ "0xdd081c00" : " mpa"
13+ "0xd9c81940" : " key"
1014 "0x4d6f587a" : " steam"
11- "0x6b66f975" : " intel"
12- "0xef3a37b3" : " default"
13- "0xe9601c00" : " spl"
14- "0x4cca7837" : " nomedia"
15- "0xe99018c0" : " scr"
16- "0xe7681bc0" : " rom"
17- "0x31461a5c" : " xfssvccon"
18- "0xe15ed8c0" : " lock"
19- "0x82795a4" : " GxCVD"
20- "0xcbe2aa35" : " ntuser.ini"
21- "0xdda81cc0" : " msu"
22- "0xe7801d00" : " rtp"
23- "0xdb581b80" : " lnk"
24- "0x7f07935" : " windows.old"
25- "0xdd201bc0" : " mod"
2615 "0xeb869d00" : " http"
27- "0xc5481b80" : " ani"
28- "0xafdf2af8" : " infopath"
29- "0xdb645841" : " mydesktopqos"
30- "0xc6ce6958" : " appdata"
31- "0xc4df0bda" : " vmms.exe"
32- "0xc5b01900" : " adv"
33- "0xae018eae" : " system volume information"
34- "0xcd281e00" : " exe"
35- "0xe3426cd7" : " windows"
36- "0xcbb01c80" : " drv"
37- "0xdd181cc0" : " msc"
38- "0xe1174b71" : " dbsnmp"
16+ "0x31461a5c" : " xfssvccon"
3917 "0xdf981b00" : " nls"
40- "0xe9601c40" : " sql"
41- "0x4c4b25d4" : " tor browser"
42- "0x350ee996" : " sqbcoreservice"
43- "0x510ef9f3" : " dbeng50"
44- "0xc9601c00" : " cpl"
45- "0xeb9f5c34" : " https"
46- "0x4ae29631" : " diagcfg"
47- "0xe1a63bc0" : " boot"
48- "0xdb301900" : " ldf"
49- "0xc23aa6f5" : " ntuser.dat"
50- "0xcb601b00" : " dll"
51- "0xdd301900" : " mdf"
52- "0x36004e4e" : " program files"
53- "0xd5834993" : " powerpnt"
54- "0xe1881cc0" : " ps1"
55- "0xef981cc0" : " vss"
56- "0xfcc8ab56" : " bootsect.bak"
5718 "0xbac47bbf" : " vmcompute.exe"
58- "0x63174d77" : " mspub"
59- "0xf1c01c00" : " wpx"
60- "0xc9101840" : " cab"
19+ "0xe4e2763a" : " notepad"
20+ "0xc9681bc0" : " com"
21+ "0x452f4997" : " -safe"
22+ "0xed2748c0" : " svc$"
23+ "0x556b1bf8" : " sophos"
24+ "0xc9201b40" : " cmd"
25+ "0x4a6bb7db" : " msstyles"
26+ "0xeb9f5c34" : " https"
27+ "0xcd6e687b" : " veeam"
28+ "0xe4e26759" : " wordpad"
29+ "0xae018eae" : " system volume information"
6130 "0xe3301c80" : " prf"
62- "0xe332e9da" : " outlook"
63- "0xb7e02438" : " svchost.exe"
6431 "0xe9981a00" : " shs"
65- "0xd3801b00" : " hlp"
66- "0x267078f5" : " $windows.~bt"
67- "0xcd2e9b7a" : " theme"
68- "0x9a8b96b6" : " mydesktopservice"
69- "0xcaea2b39" : " oracle"
70- "0x6d52e873" : " memtas"
71- "0xdb975937" : " ntldr"
72- "0xd16a78b9" : " firefox"
73- "0x49679973" : " excel"
74- "0x30a212d" : " $recycle.bin"
75- "0xc9901d40" : " cur"
76- "0xc9e76a92" : " synctime"
77- "0x5366e694" : " perflogs"
78- "0xeab24db7" : " encsvc"
79- "0xe97eaa7b" : " visio"
80- "0xa6f2d1a7" : " application data"
81- "0x67b00e00" : " 386"
82- "0xc99eab80" : " icns"
83- "0xaf16c593" : " themepack"
84- "0x45471d17" : " -path"
85- "0xf00cae96" : " bootfont.bin"
86- "0xc8cef7d1" : " thumbs.db"
8732 "0x86728ff4" : " ocautoupds"
88- "0xd9c81940" : " key"
89- "0x8cf281cd" : " config.msi"
33+ "0xd59818c0" : " ics"
9034 "0x86ccaa15" : " autorun.inf"
91- "0x556b1bf8" : " sophos"
92- "0x4a6bb7db" : " msstyles"
93- "0xe3101900" : " pdb"
94- "0xc9201b40" : " cmd"
95- "0x52cb0b38" : " google"
96- "0x49164931" : " accdb"
97- "0xcd6e687b" : " veeam"
35+ "0x8cf281cd" : " config.msi"
36+ "0xe332e9da" : " outlook"
37+ "0x635318f3" : " mepocs"
38+ "0x45678b17" : " -wall"
9839 "0x846bec00" : " iconcache.db"
99- "0xc9681bc0" : " com"
100- "0x82d2a252" : " desktop.ini"
101- "0xba22623b" : " all users"
102- "0xed2748c0" : " svc$"
103- "0xe2795e4" : " GxFWD"
104- "0xeabb69d7" : " agntsvc"
105- "0xfe9e7c10" : " runonce.exe"
106- "0x5cde3a7b" : " public"
107- "0x26687e35" : " $windows.~ws"
108- "0x3907099b" : " boot.ini"
109- "0x12018c0" : " c$"
110- "0xc7a01840" : " bat"
111- "0xab086595" : " program files (x86)"
112- "0xdd101900" : " mdb"
113- "0xe1c018c0" : " ocx"
114- "0x452f4997" : " -safe"
40+ "0xcbe2aa35" : " ntuser.ini"
11541 "0x62e70b13" : " onenote"
116- "0xd4aaebb2" : " admin$"
117- "0x56fadd39" : " sqlite"
118- "0x64e29771" : " diagpkg"
119- "0xd56018c0" : " icl"
120- "0xd5c01900" : " idx"
121- "0xdd481cc0" : " msi"
122- "0x635318f3" : " mepocs"
12342 "0x4aba94f1" : " diagcab"
124- "0xe71dab3f" : " TeamViewer.exe"
125- "0xdd801cc0" : " msp"
126- "0xdd081c00" : " mpa"
127- "0xcd101900" : " edb"
43+ "0x4ae29631" : " diagcfg"
44+ "0x2f9f9ce4" : " GxVss"
45+ "0xd4aaebb2" : " admin$"
12846 "0xbc225b52" : " msaccess"
129- "0x45a5f154" : " thunderbird"
130- "0xd59818c0" : " ics"
47+ "0x3eb272e6" : " explorer.exe"
48+ "0xdd181cc0" : " msc"
49+ "0xd16a78b9" : " firefox"
13150 "0x616e4b78" : " ocomm"
51+ "0xafdf2af8" : " infopath"
52+ "0xe71dab3f" : " TeamViewer.exe"
53+ "0xfcc8ab56" : " bootsect.bak"
54+ "0xe2cb9b97" : " winword"
55+ "0xf1c01c00" : " wpx"
13256 "0xc9766874" : " thebat"
57+ "0x82795a4" : " GxCVD"
58+ "0xeab24db7" : " encsvc"
59+ "0xb7ea3892" : " msocache"
60+ "0xb7e02438" : " svchost.exe"
61+ "0xcb601b00" : " dll"
62+ "0x56fadd39" : " sqlite"
63+ "0xe9601c00" : " spl"
64+ "0x45070bd9" : " vmwp.exe"
65+ "0x9a8b96b6" : " mydesktopservice"
66+ "0xc9901d40" : " cur"
67+ "0xc99eab80" : " icns"
68+ "0xdb581b80" : " lnk"
69+ "0x85aa57e4" : " ntuser.dat.log"
70+ "0xd56018c0" : " icl"
71+ "0x12018c0" : " c$"
72+ "0xef3a37b3" : " default"
73+ "0xeabb69d7" : " agntsvc"
74+ "0x82d2a252" : " desktop.ini"
75+ "0xdd301900" : " mdf"
76+ "0x510ef9f3" : " dbeng50"
77+ "0x6d52e873" : " memtas"
78+ "0x69264cf8" : " ocssd"
79+ "0x26687e35" : " $windows.~ws"
80+ "0xc6ce6958" : " appdata"
81+ "0x52cb0b38" : " google"
82+ "0xe9601c40" : " sql"
83+ "0xe99018c0" : " scr"
84+ "0xc5481b80" : " ani"
85+ "0x49679973" : " excel"
86+ "0xdccab8dd" : " mozilla"
87+ "0xdd801cc0" : " msp"
88+ "0x43b64f11" : " tbirdconfig"
13389 "0xe9981e40" : " sys"
13490 "0xd57818c0" : " ico"
135- "0xdccab8dd" : " mozilla"
136- "0xe4e26759" : " wordpad"
137- "0x69264cf8" : " ocssd"
91+ "0xdb301900" : " ldf"
92+ "0xe1174b71" : " dbsnmp"
93+ "0xaf16c593" : " themepack"
94+ "0xf00cae96" : " bootfont.bin"
95+ "0xd5834993" : " powerpnt"
96+ "0xe15ed8c0" : " lock"
97+ "0xe7801d00" : " rtp"
98+ "0x97a4e3d8" : " isqlplussvc"
99+ "0xcd281e00" : " exe"
100+ "0xcbb01c80" : " drv"
101+ "0x2e75e394" : " programdata"
102+ "0xc7a01840" : " bat"
103+ "0xd3081d00" : " hta"
104+ "0xe1881cc0" : " ps1"
105+ "0xcd1b589b" : " x64dbg"
106+ "0xc9101840" : " cab"
138107 "0xa1fccbfe" : " deskthemepack"
139- "0x45678b17" : " -wall"
140108 "0x5b0e4d71" : " backup"
141- "0x97a4e3d8" : " isqlplussvc"
142- "0xe4e2763a" : " notepad"
109+ "0x267078f5" : " $windows.~bt"
110+ "0x3907099b" : " boot.ini"
111+ "0x45471d17" : " -path"
112+ "0x63174d77" : " mspub"
113+ "0xa6f2d1a7" : " application data"
114+ "0xe97eaa7b" : " visio"
115+ "0x36004e4e" : " program files"
116+ "0x5366e694" : " perflogs"
117+ "0xe2795e4" : " GxFWD"
118+ "0xc5b01900" : " adv"
119+ "0xc9601c00" : " cpl"
120+ "0xdda81cc0" : " msu"
121+ "0xe7681bc0" : " rom"
122+ "0x4c4b25d4" : " tor browser"
123+ "0x4cca7837" : " nomedia"
124+ "0xdd201bc0" : " mod"
125+ "0xcd101900" : " edb"
126+ "0xe1a63bc0" : " boot"
127+ "0xcaea2b39" : " oracle"
128+ "0xd5c01900" : " idx"
129+ "0xe3426cd7" : " windows"
130+ "0x67b00e00" : " 386"
131+ "0xcd2e9b7a" : " theme"
132+ "0xfe9e7c10" : " runonce.exe"
133+ "0xdb975937" : " ntldr"
134+ "0xc4df0bda" : " vmms.exe"
135+ "0x6b66f975" : " intel"
136+ "0xba22623b" : " all users"
137+ "0xc23aa6f5" : " ntuser.dat"
143138 "0x7979b24" : " GxBlr"
144- "0x85aa57e4" : " ntuser.dat.log"
145- "0x2e75e394" : " programdata"
146- "0x2f9f9ce4" : " GxVss"
147- "0x45070bd9" : " vmwp.exe"
148- "0xdf301900" : " ndf"
149- "0xc9681bc0" : " com"
150- "0xcd1b589b" : " x64dbg"
151- }
139+ "0xef981cc0" : " vss"
140+ "0x5cde3a7b" : " public"
141+ "0x49164931" : " accdb"
142+ "0x7f07935" : " windows.old"
143+ "0xc8cef7d1" : " thumbs.db"
144+ "0xdd101900" : " mdb"
145+ "0xe3101900" : " pdb"
146+ "0x64e29771" : " diagpkg"
147+ "0xe1c018c0" : " ocx"
148+ "0x30a212d" : " $recycle.bin"
149+ }
0 commit comments