36b3ef72...582d | Grouped Behavior
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Trojan

Monitored Processes

Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xff4 Analysis Target High (Elevated) 1csrss.exe "C:\Users\FD1HVy\Desktop\1csrss.exe" -
#2 0xd98 Child Process High (Elevated) cmd.exe "C:\WINDOWS\system32\cmd.exe" #1
#4 0xdcc Child Process High (Elevated) mode.com mode con cp select=1251 #2
#5 0xfa0 Child Process High (Elevated) vssadmin.exe vssadmin delete shadows /all /quiet #2
#6 0xd88 Autostart Medium 1csrss.exe "C:\Windows\System32\1csrss.exe" -
#7 0xda4 Autostart Medium 1csrss.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe" -
#8 0xdbc Autostart Medium 1csrss.exe "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe" -
#9 0xe78 Child Process Medium cmd.exe "C:\WINDOWS\system32\cmd.exe" #6
#11 0xef8 Child Process Medium mode.com mode con cp select=1251 #9
#12 0xf24 Child Process Medium vssadmin.exe vssadmin delete shadows /all /quiet #9
#14 0xc50 Child Process High (Elevated) 1csrss.exe "C:\Windows\System32\1csrss.exe" -a #6
#15 0xb88 Child Process High (Elevated) cmd.exe "C:\WINDOWS\system32\cmd.exe" #14
#17 0xd74 Child Process Medium cmd.exe "C:\WINDOWS\system32\cmd.exe" #6

Behavior Information - Grouped by Category

Process #1: 1csrss.exe
18257 0
»
Information Value
ID #1
File Name c:\users\fd1hvy\desktop\1csrss.exe
Command Line "C:\Users\FD1HVy\Desktop\1csrss.exe"
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:01:25, Reason: Analysis Target
Unmonitor End Time: 00:05:22, Reason: Terminated by Timeout
Monitor Duration 00:03:56
OS Process Information
»
Information Value
PID 0xff4
Parent PID 0x860 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 390
0x 770
0x 6E4
0x CAC
0x E0
0x 8F0
0x A90
0x 784
0x D44
0x D2C
0x C30
0x C38
0x 344
0x ED4
0x F7C
0x C04
0x 654
0x FEC
0x F60
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\Desktop\1csrss.exe 92.50 KB MD5: 014ce7dd8860b2dcbab3a8d5ada84cf9
SHA1: cdd35424ab9c45a46b3467867500162e84530471
SHA256: 36b3ef72679ab1bdf384892aa721db4fb42971618510081d206d61a90ac3582d
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4A2Q1+ozUHXCuv8tRCqoaPNJPZE:Qw+asqN5aW/hLiHHSbtJrNM
False
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[lockhelp@qq.com].gate 0.37 KB MD5: 748306600748fdfe6948d0c1438880d9
SHA1: 260d4c109ccba73f4ed916de2ae41e71ec0a5200
SHA256: 27f14b53f7ccb3958ef8b55f72cc3bef141000969e2651f2abf663bb39d92aa6
SSDeep: 6:QIJFGyYqXHGxyHr/1Hg66WCgxLf5Q/zzrnBreYHSzyd0e9My7viSsizl:QIJQ+XGHh45Qqyd03MKSsq
False
C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate 0.55 KB MD5: 5f143df2819599979259140dcbff4ea1
SHA1: 04e54a96bf7e6bc741194d3573757b597d5b230e
SHA256: 407628dcda44349480f643905d0f3b326a839bfec926da855b1886ef7e68dbf4
SSDeep: 12:XvfFFQC8q3hwesMXhZlNfekd1kFH8lBonvjvMCRYp1YsJl:Xv3pWgPfNLkFH8lgvDMCRYZ
False
C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 17.09 KB MD5: 95bf5fd3459c5d39d971b8e8d8f9698b
SHA1: a7e7a91d40a7775b601ac69175ff20be8c5404a9
SHA256: 85190d6320c7de9a1da6e7af50f1c7b8c2f00b01848b8f8505a65b6d7c717f42
SSDeep: 384:9m9cpu+bobOWZiPOXkWRdA5vR7Ura8WgL1PXY3c8Io2Ow0rK8uMxP5O:scp5kbOWZ4TKA5vG2gL15obeIO
False
C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 80.66 KB MD5: 537f45e9ed161cd0668ddad02b0d0cd9
SHA1: e3f197756dc65c9d2d13b4b88599c21a9d10eb03
SHA256: 823ac62695965ee70ee231f675b418cad7d53f9ead42892eccc61e803025127c
SSDeep: 1536:w85zRfCWKMBr4z/RUnUNJy17fvCkVpZbVtuuUx5VYoQ1bO+kVTOVn0xxtbiZZg:XzRfCWK0Y/rNGfakVDbVtuuaYqlOV0xP
False
C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate 173.83 MB MD5: cc75e7bda8993fedfe1a6badcf08dce7
SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed
SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c
SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp
False
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate 4.30 KB MD5: ad94d23bf169c938103e3fe5c045afc5
SHA1: 7285f06b10d65dba1fb55f2317047e4aa841f08a
SHA256: baa89fce513b806f82fe2fd4ed8a35ce7e1d7329c4422197e3e618310bf23100
SSDeep: 96:ip4otK8YRQuDxmSP3M7xEwxDXpzfhSe0+mZXBzYWA:i4ogXKSxmSvqBNfh90+m5BzYWA
False
C:\588bce7c90097ed212\Setup.exe.id-B4197730.[lockhelp@qq.com].gate 76.55 KB MD5: 579c12975524646c5b159659f895daaf
SHA1: a6d4dd46da2299c9aa464248e8239444fd76f3fb
SHA256: d8a9de1db615e22dbb397d161386fff3edc104d9d1c9b7b9bb8a84a195cd4755
SSDeep: 1536:fBgB4Pf3JXTGD5vfCqVyUnyc2OowNn4KyPPcJDFoPC+Tr5Cbi:fs4Pf8rVy80O4KW2oPCGr5oi
False
C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate 103.25 KB MD5: 1ac95d69916284a794a26eb763e6b746
SHA1: 2c04bf72b8aca39718698acd2e1fe0fff6c58ac3
SHA256: ef47f37a4566f4fcd0ef84bf06785945db6e420ebe1ef2dc03a6eed42e1bae60
SSDeep: 3072:TBNY4avTTG5BndGSwWJbWQinv9AWZKgdKLrJ:NNivXw5wG7Sv9ApeKp
False
C:\BOOTNXT.id-B4197730.[lockhelp@qq.com].gate 0.24 KB MD5: 25a2600b7d7a3a82bcf24f820f821538
SHA1: 10955e71267f7e8ae2533a02c129a6600675aaf9
SHA256: 19f6602ff4149145900355132f8e04161e423c61067a47012bdb1dbf9d41f450
SSDeep: 6:XSlgkzxLfc7w6dfYjVkoLMMBD5JfJeNh71Ysdl:W5c73SjvMCRYp1Ysdl
False
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate 0.31 KB MD5: 6e33a2625b2c9c3795f7cf39c31f7626
SHA1: a509394692f7247fbdcca3831940778f8a164571
SHA256: 94ead482100e28fa8f07924ff8394133b3753582b1df30e7dd7f2f03bde4812b
SSDeep: 6:vBlZETZJsel1DmRH8lD7gjglxLfOswTtrnBreYHSzyd0e9My7viSsill:xEzn1UH8lIjo1wgyd03MKSsI
False
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate 6.14 KB MD5: e5e81df7f95712a87baf1228a214ae2a
SHA1: 9e9f8475968c774e6b33b29fde56f31a5ef9f1a2
SHA256: 83ffda20446f1a5b5b4413b67ef3679a8f0eca12d86740d467f47ec1caa90587
SSDeep: 192:J9IymIaLcWa+MHn9jfH01FgsyVUDPSUPvcO7:bGVwWaXtH01FgsyV2PSUMO7
False
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate 41.97 KB MD5: b04326f883abbe482d30b669cce10135
SHA1: 1ec1b7dd2a82cb321792d4b1afb1044be3b100ef
SHA256: 8335021d4221ad2f8db5fd454d09ab3fadc4bc7aff69a838edb11c70580d81a2
SSDeep: 768:djJjfVX0nnR7FBmUUvzZm+JGnIcIJbb+DzXIrpJRFMPl3fJFeWWjGm6sx+13wThZ:djtx0ndCU4ZwnIce/+DzXARFQFfm/6Ct
False
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate 0.37 KB MD5: 99463159c3382814b3fcee56c5af2634
SHA1: 252de22a60b4e4af31d71cbf6bc713494dad9c2d
SHA256: 33c4a01e1e5cf61abc0820da93c9687b6c2befb4a1abe04deec85fdcd3dc68f9
SSDeep: 6:Tu2nTNzslvrwAuKgXZUBur+ga9CGVc6WCgxLfZrnBreYHSzyd0e9My7viSsizl:imNmsAuKgIur+FCGV34wyd03MKSsq
False
C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate 140.95 KB MD5: edeeb62b7992f4facd3644d4988a0e1d
SHA1: 28ec011328809410d836dcba363ce582556b34ac
SHA256: dd8ed5c01474006f8708d4fac1a50bb2df1954b77f4ba4d0de5f2a90791c1e65
SSDeep: 3072:qAh2BLGqWvyXEyNLIJmZDKxxoVJFc9hfnBe6yF7sV3SC9Nc:7h25WvkqJmGxh9xnB/yf
False
C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 7.61 KB MD5: 30e490d1f160f94985967debca2d8f67
SHA1: 17bd006ef60c90a1fb38c0c6341d7f4a83e23ff9
SHA256: c2275bb56d7d8c6d939e91cd018506d0c6ba089a8f641696a015c51afbb65d6f
SSDeep: 192:/Q9X5rx9raWLeTacu+il5YYW7lSA+UciLG8fXb3TyIudr:/QD1sWLew+ilxW7kUcia8fLTyTr
False
C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 17.09 KB MD5: 5b6dd092c1f4c3b717b2a136cd3d567b
SHA1: ee8efa46a058f2c32e1130da0bfd134434fbf374
SHA256: e7ca95086067b0e7ab9a5736c5222550213305f64972fb1321e280f372d70617
SSDeep: 384:SHWXbbSDjcpoyLPxYqF/0vbXFnwSYWjY6dozZJaWbTlidIjtFYEO:McpXvyF6WjArhbTMcw
False
C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 72.72 KB MD5: 3ecf10a6dc670754be8bab31e6ef4298
SHA1: 07034bab9e82bcb7f29ed31898ddae5bd57ad7b3
SHA256: e181cb2c8613e2213306329cc2d363183064088eed3f3cf1758b851a88695dd1
SSDeep: 768:2GMVBwXQ8Bwz8hLpvFcfy+c2m/m0BTMOi+DXVGJvpwcf45I36/Vi+3a3a/rRpd/2:ezwXRMRsPDBoiZm6/t3aKDRpdbvaen2z
False
C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 6.39 KB MD5: a39d079d8c0b822985a50f8b77974f36
SHA1: 81ae99a3d01f02240541e15027481a66c64a35a0
SHA256: f9f0028760a5a22a62bb9e39af95299ab39872061a4ef1d3e1f7c7e986a3fccf
SSDeep: 192:ZDwJO96UDY6/GXcHcwHsLNwU1puOybZ3FEzzjfwKW:ZuO96UDY3nLiQoDC3joX
False
C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 14.09 KB MD5: 96f3ea224091ceaa45cc849d9614ab79
SHA1: 08650e99b184bc2cbe2138707050129886b319e1
SHA256: 60e4accec256e68bf9542f21af12e23014e1d038d65f9d44097d2436a3f74c3b
SSDeep: 384:STYeU8iUKWI/RJwIMtjt3BqWxEaWih50F3d9O:Sv76WI5WIMrLq7Y5k3K
False
C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 59.65 KB MD5: 63fe50b4dbf9736056c2db77bdf94d67
SHA1: 5593eed5832f2e40111a007ce531884385b6af45
SHA256: 4630d04b5cf1a97d68e4e581cc65d50493a1289134393115883abdf4fc50ce14
SSDeep: 1536:eEA3E2mvepbzPnKxOBlaDEYD/RYUtnholtGbYLGtr4b6rjmHuNLqVHa51y:eEA30KbzPn2sa/F1KGtrc6rxOw4
False
C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate 0.31 KB MD5: 015b9e6d7762159a7210c30cadc250c8
SHA1: 5edd6b52a3cd9e0f7e484a96f9c72fb9ddd5b66f
SHA256: d72e68f72929c78da88fe06f165ed798a21fc881ff42b41d02ae414a8ac8487f
SSDeep: 6:EzEUAOF0F6ZAxk/UQlSan6xLfTSZiSYjVkoLMMBD5JfJeNh71Ys/:EzEKU6Wk/canociVjvMCRYp1Ys/
False
C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: ac4270a461771fae191a0a1ce61acc71
SHA1: e7ad15d0c429eb07e3580136b1dafd1d5cf09685
SHA256: da8980ca7e6658d8636eedc39a1b5e56f68c3cbc33ec9226a2a9a10e27fea3d1
SSDeep: 384:XNvGuOUO+h3zEJHp2xmHfNImuobIuAafVGWVFZMUqxIqXuvhrqPrRqiO:XNZO+3gJ04fN3Z9GwF6UxqXuJcQ
False
C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: 68b70c74f7b17a5d539914f23519d044
SHA1: e984fccadd1b186b5b02cd53f9414808c79afeaa
SHA256: c73b4fbbdc8f98bcd0e699498b5b9c6d38df2d18deeedf2ae3f94c079214ec79
SSDeep: 384:sLSfgNtXLmbjredRj6jTxyfneTfIQG8vPvk5OedUHtSvRaNo/OVO:SSMtyHredRKDpG8vqzSDor
False
C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.59 KB MD5: e9a994a4e5c7c5c907eae0a0c98fdb24
SHA1: c335a7acb8ee6d289f22faf198d2720d93ff2b5a
SHA256: e85ed574d99552c8aa29e4d5e6bb783fa42918b2e5ff49c9a79d6efaed97dad5
SSDeep: 384:w1eFNNLZw7/jD5tazCaGLcmdquNp2ZrVolq7BfAMrfFjbCYep3XEHeO:J5VErD5swpdLN/c7BflrfozpnA
False
C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: 320c523ea94f70c04952bebccac9a65d
SHA1: 2f586068e3e26d4296204357f6b515afd202a8b9
SHA256: 954c9fb8c24be0c6bcaa7c0bfe6feabbc04c08ef3b13fe0ecb0181027e0afa2d
SSDeep: 384:u5v3gQtuFuLT3QNDuV1xznohXxJ2+wda9uVUg/3yX/fMuDITNQ9nmgNHKjll30O:u5vwQtQuLT3QsroxJ2+PuVUE3yXMuDIX
False
C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.59 KB MD5: 7b2eb6b6cd4756d09f71ad3198ef0062
SHA1: 0111f632c17dbb60ee01ef61bc4d8e388505a1df
SHA256: eb8d28ff2314cb7bd03eb707ce66b18cde449bf3062836e82bb447ae637fe8cf
SSDeep: 384:d/jVw0Fj6faAAzn3QVLxt0U/QbyuCaVyTR/jKs4fRYRZaeAO:dLVw0eEzgVLxt0d6YRCd
False
C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 19.09 KB MD5: 181eb008410a0cefaea0042f5bbcb6cd
SHA1: 64c3046efdb218b86927d0f67dfb404d6c2a3702
SHA256: a6e7db5bd40b15a217bd3c4ebf9bafa590a7cc0a9dee1c4af441488461e2be0b
SSDeep: 384:dFVXYg/FX38IAICx06Ctb+vbFX9gWpnmGlrpJ+FH0TsUlw2WfzO:dFVowFZbYiWpnmHeze2WK
False
C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 16.59 KB MD5: 580d1664b66358f626b6e7307ee54669
SHA1: 867501b1caf9efcda64446398648e443a105fdb5
SHA256: 8da1c06379e38e264b204b6f27161d20c16717f54d6c1cf01db7d8dbdeeb8868
SSDeep: 384:MN6Q4owWMuGYwJIwA3ees+98zpPW8edIOXwDi4fO:5Q44oYYG8zpPW/dBXJP
False
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate 0.41 KB MD5: 3caaf97b7e521238322b57ce1a3a7784
SHA1: 812bcdf719619b719ad69f80ceb5d62ae06865cf
SHA256: 0bfa25f9c6c8e63aae8840949c66794b97f07bb8d0fe5e69246c55d3cbd5f07e
SSDeep: 12:fC1TSGlGWn5NZgly1Qa9/laq64YYMyd03MKSsY:qCygly7/laq2YMm8tS
False
C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.59 KB MD5: 24d4c43510197dc9542c7c66b80dc309
SHA1: 97a9cbad81144fe63467186f2ac93a927c8ac193
SHA256: 988d9ae78cf932c8d9769cf1956315aeed5af03a5be1f1a9f80eaeeae0f5c5d7
SSDeep: 384:BVn/BgEKz1oo8730UXIMYrMOXWZlxrLFA6xwSa4qtJ1evz0KOTDII1O:P6EKZoD7EUXIMYIixbSa+zdOTkl
False
C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: 93ac5cf0aedf1f45da18dc8ba06e64e5
SHA1: 311bf51f68db9c053d47c1e30c162e39292bbf2f
SHA256: bd7e036f8a3ce75109f6d21de5dfaf2a1266b4a6a19b345df56b795211f96e51
SSDeep: 384:EhllucZkiy+TWBkMRExJCsEB3R03tsxhQAIM/YsxgLqoSv88OO:EhllvZkiyl+CsEB3RgtHAVgX2fv8i
False
C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 79.32 KB MD5: b482520df582aa7193e395b1f8f0d661
SHA1: 9e4101c187f3a521956bf3cbfa0855c2ab60c0d6
SHA256: 49d53b45f496a4e08c762e33eb6c3e2d0e821cf660ff6a582c760330500cfd6f
SSDeep: 1536:r0PLGJSHe8cxGRF4ki9EB7R+q1zMlNL3x/XOqQxY53O58riypnC:r0PqJSHOxMFnRZ549fpiypnC
False
C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 19.09 KB MD5: 09f453eedc61043c35d2026228f61a72
SHA1: d0a787d9ecd547f17fb26886a301e7073fa5848c
SHA256: d99c5c5baf00d1288f2b9493b5e777122917130e0123379b384b7be8ac8b9ac5
SSDeep: 384:OwSpc/nKwl15AFjGM9e3oNLqP3vv5GiZhbw64BDprNK7/i+O:hGrFf96EqPVb+Ru/c
False
C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 15.09 KB MD5: 82a63bea6758b514316c2af458dc1b76
SHA1: 59df1fff223865ee79fb7b75477b2d9d1b8d8cf0
SHA256: 07c27c26f5f214fbd7259ef6965d62b6d305dd87170009533564840b15d032f9
SSDeep: 384:doTfBDAn8nMqPHbn8iYDojGqDc7MbgtCl6mv+HO:doT5lHbn8iNjzIM0tGbvx
False
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate 0.83 KB MD5: 704f772e00de0a5da656a3bdf245157c
SHA1: 128b6fcf2d22a8816f75e851badb43cefd467e1a
SHA256: e38d19d0d6a40b1fa33dcfbb6376afa086ff1ad662a14fff7d876b8545c476fe
SSDeep: 24:je6TZGXHmUZ5dNTtP7GHg+IeH8l3DMCRYf:je6tGXHlLF7Gbr8l3oh
False
C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.47 KB MD5: a7cd2666d4b6ad5a20ea1e5758cb1a53
SHA1: 5ac294fb533bf1611aa4c4aa5c1cebe4ddd90018
SHA256: 0806cacf71e4d56eea594576a222b112282d2cbcc24b1f1a9c3e795ab597957b
SSDeep: 48:YMO1VXe/gJ5Vx/tkoyTJBpkzgugsz5eGFX478Zkfx8drlWft+nK/orZ2ly0:YMO3kgVfkoyZS/VzX479JiZWV+nNa
False
C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 76.18 KB MD5: 8b2ea2949d8c2806d1058f37b8043255
SHA1: c00d464d553657943ab3fa4abe9907d28d7291f5
SHA256: 583ce69a8fcbc4366a83c3553efc657f99a5b00bb714147e45e81d811202e6d3
SSDeep: 1536:qKllb7ecUdPWiYDApcQPVjqZiCYBdO7ZITwxDFMbRFDox1AKbudTk7jjX:1Hep6Gc6Vj4EYCTwVFMbRFDvKwk7X
False
C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: 98d255cf0d1296572dbc3b51acbb2a78
SHA1: fe779ca6fed8dfae309e1cebf373b75f6c4bb4af
SHA256: 1f079fa49a3066c3fb7f0a5ad95cf5dded37e8980920fd60384cceb90eb33b3f
SSDeep: 384:lHcjE+tiC1fjTUFgrAiBIFzXf622jt4qoV1fgkq3GD1MJLh9hO:NcjTzfSgrAiBINXiTjthAxZF1Mhhu
False
C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: a85a6fdb0daad32e8fcf8203fcf156d1
SHA1: a4e347e35fbc65ea41f0ff3cfad0dba2e14a882e
SHA256: 3faca2d65f6a1b887c978e2c7c268e127390ea22fe8abcb6b4023e27cab569bb
SSDeep: 384:cFCv5aBvHWmLCrcp1eOuIAJSj9ZjAmScVKvIFqAtRoKaQ5+8Fb0KxV1ZCMqbbR1Y:QCv5c+reezjSj9ZjApZvIFqAvoKaQ5+U
False
C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.86 KB MD5: 5fec85ff6f19b0f952eb9e540f2870ad
SHA1: f5f5223dde5ec19b683d865f1a01cb42cf0ad6b8
SHA256: 89c06d3f71a7947855530d8f6618ac519600ef426db958dd2def1158b4c15265
SSDeep: 96:tT43ggc9g+ogEy5zg7Isy0rKb1PXfEJ2BE7gqwU0ydEQ:qQgsgHyZ10mR5Anv02
False
C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 17.59 KB MD5: 8374e29badb562d8437bc579172292c7
SHA1: 629fd62ab099554fd9ff6feef925f9bcbdc5bd05
SHA256: e9ec255030912c150f58114407561b928b50f8049d4b946d174b4f5a428d69ee
SSDeep: 384:EkuOmWnlgy4shs7w1xM610ODEIqSmaiN8HAiuIcEhJVbw2U7/eojO:wR2eV7w1x2ODESxvHAiKICx7s
False
C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.57 KB MD5: 8d45177a50ff32de1efd609d4e81256a
SHA1: d946ff10725070086472fc0b029b906983a55e72
SHA256: 1308df1575fe69a300eea47d7619ae11e9f8b47b9407133049f91c18910ea24e
SSDeep: 96:uIyxBxYxjzj+ov9OiSh2tWYhJoJknMHw8:uIyxBxYxp6UF7tn38
False
C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 17.59 KB MD5: 8525bd2b12ec38ca342a4d8b9af72a16
SHA1: ee31b9f0740f54ee55902e12dcebac1e60ba4348
SHA256: 09fb34d4d3b2f0d185e10f88ddce4ac2f502954fe7f715426e05bec5733daff7
SSDeep: 384:ij2OzL6XIZeFFnrvgnU07wTpz1DTYdnLT7ZhQRg5UTCAO:iiY3ZevrcU0cpz1YdLXPQR2p
False
C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 84.51 KB MD5: dcd49288094eeadf507f4bcd14b82b95
SHA1: a7c953685dd515c16f9a2f6257f70668b6a491d5
SHA256: 9b0c199bb80643b7210e2819a3b17379fab16ca136d87d3cb153606e2e24aa26
SSDeep: 1536:cBACj3ZeUVmNKGpKjPotHlrkcj1sEhfkHxnDS+80j/BfNNkAYfadPvcfyUFL:cR38UVWxKjwFlXj1sEh8HxDS+80jBfz0
False
C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 14.09 KB MD5: b48312c39ba5152bb589b4e6eebf14fd
SHA1: 80835d4fa5d89f679f680b8af2e43f1ec3ee3afa
SHA256: 68187fb51dd8429276cdb66455fbbb0906f901d9f01cfb9a900c943f52a4f5de
SSDeep: 384:p4UaXu7mwxIeHZ1sg5Ppm7fWd7LkQlax96jYyRxT8V7GenxO:pBUEfWe5Sg53n9c36jlRY7G3
False
C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 8.89 KB MD5: 0e5983b88b1eb5df0bda1c6c72605a44
SHA1: ffd2583edc65df983c643460633f3ae4207f7fec
SHA256: bf1e8e789ea6fcfd84e0463fff18475c32da83fc6dbac71d67ce31e787bc1f86
SSDeep: 192:sO/JC1omWcIXN0HIXpvvAIrEPsdaJuS3eIjod6izeSf7TFXNCc82+:f/6R3IiMv45PsAQSOc7Sf7F58z
False
C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.35 KB MD5: 2993db64de01486604cecf6c2d88afa5
SHA1: 2485ffc70d51a1fd21029fd1aeac3fbb024711ed
SHA256: 529b0f393825788fb4734f56c1e8ffbc44d0979d8072922d7b7af0392f65602c
SSDeep: 48:2+B+snWP4OgjJ2YeD546+YBEkHmW+V9m5KXAfGvyfarGtKHVDlwd/AFsqxHTA:2urHTj4pDGlkGTVYkXAEyg3wd/AFsqxs
False
C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.09 KB MD5: 1f232332de9f21800eb68b40fb688a66
SHA1: 435473761f406ec7b88b2770451f027859cbbc3a
SHA256: 3717f01f26bde9eee93442e0fb60d0ab16434713f191fe3af224911f7904986c
SSDeep: 384:AdiCO7IQEA+Ku8w5gFyQMA2BqtGJ3HKnZdxaI2Q74JPjNYzups6yMjIR85O:Adin0QEA+RZQMAK9pH2NYkg0Rp
False
C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 15.59 KB MD5: 8c6991245a3b02d278899f9ade1cd8be
SHA1: 26d4b467ea53f53ce6de17310aab03ac90a3eb59
SHA256: d3936e119f80ffb6e059173a9a80a985b5dc78b7694e8078850f9f7266acc369
SSDeep: 384:i7w1WUCbRa8VRR2G5tPfZ+W5qEtFP6ci5KzKjhio+HqrD77aqO:l1WHbE8hFXPfDUEXPNi5KS+HcDo
False
C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.85 KB MD5: cc627421ccadfdba61f583721140acba
SHA1: 5417e69d275145c097c183a9535288b22d893c68
SHA256: 94d31f88ddf34034b09e1eb1aeb1925f411287a98df4cc05f73accff20a9d99d
SSDeep: 96:LVUvJMiIy6XoiCuSVisM4jRD1Q9PkzDXnH29mnEKZKQ938:LVUvJMi0mVzfpomDXWFE9s
False
C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 75.46 KB MD5: 8b1770bcddf1bc54a9258e2e124ddacb
SHA1: d7267546d0ff2ce2ef83518eec7498b93bd9aa43
SHA256: a657a435345b4feefd53a52c5d7dc4618c36e22c3a41ef6d08d9a6092b512730
SSDeep: 1536:PKOesZw4qRz1ytNcnecq6rVd1dd72LY2RXNuI:P5p+JXVdfk82RXNuI
False
C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 14.09 KB MD5: 922cc76216c903b02b8b3b1f255b57a4
SHA1: 39354994d276b4510419dfdddf23468f9c989b34
SHA256: 46ddda7eec2514bf626d3ce1a11d46f494a1082a71c81d6c8fd1259547c95250
SSDeep: 384:OUKTu+kDv4f0e/FeUf4+dX701ykCYiYdb3EVSHO:OUKTu+Nf3NffPXm3db3ED
False
C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 75.68 KB MD5: 0e52a9b316c3f3f3ccfdd00c8a587109
SHA1: 3e6b781f9b9d5d70d2077ad676fb6f4cb2d1ca8b
SHA256: 0f53e92e2510c50f7bab128d915b5268681c82f18f37dc41ee112b56585afd63
SSDeep: 1536:wDUmIpTkWB0D2LPrVUEIHxtpz1oGL1vWv5laQpRe5:w4mIlD6EIRv1Fk5/M
False
C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 17.59 KB MD5: 71a17d52f0b661e44f2480c193add321
SHA1: cf25e3c2bfda6f1a7ae56f52980ffbcdd2f94cb3
SHA256: bd4be8a8ea6ba913d3a2a2cae45381674b1fb26f4de4c77967e519fb9d811ce4
SSDeep: 384:ccpaAny+YJVPJ0w4Gu4LoJowq1PXqxy7kNZrcRuVsNt+C9O:ra8y5VP6GuEioN1kf4uuNM
False
C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.68 KB MD5: 8f37fee41f499c8ab6bb102dc55e3d5b
SHA1: 6128696ed2c7364e263437204185d166289df39f
SHA256: 3d33fc4989e9f07367cb2e7299c88cc8f7caa183a9701391e35c2c5fdf406874
SSDeep: 96:52vOySEDZbD40pzFGoBUm9e7Fm4d0PMj0i:52vbZbM0V4duAm4OPsD
False
C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.59 KB MD5: 851ea9580804dc0075e10665da904722
SHA1: 62c6f2cf052578b47f45a1a4ba48f03efef15703
SHA256: 9fecce157a4734e8c73dd124c8710d0c3b4d65101a2ec689a940bbd6a848fe35
SSDeep: 384:EfDQ/2vLSUr+D2BHpPs/N6t+AIHDu+eQZ6vLJpK9NBrSXg4kro5OZ5O:EfDQ/cLSUr84sO+/jZMT0NAwHro5R
False
C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 70.63 KB MD5: 4246e7782b31c73ce97a360e1d3064c3
SHA1: 101037f4d89da6962138735779cd894d1f12b782
SHA256: ba6f5971c22e1fbcb3df7e188fd071aa54adba45a0a30f3caf983fccd58282af
SSDeep: 1536:jKAVuBw6OBHp7bmIr5vKiTogoHPYMq0+lYTP6MVG7V5UQjdzW58iYo6u:jKimQ7bhrJKdbHPY6eYTP6WSvJzWhgu
False
C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 4.38 KB MD5: d033fb5fdd96362da19dde2d35bffafa
SHA1: e81977661152741f81b290b7bf30c3d4d746c69a
SHA256: 3cf7e7b5253d765eaaf73726ada1a67c958a2425ee8624ec67963050c66f432e
SSDeep: 96:orHmuDIVZwpJ8r40iT57mW87NCnTmkd6b8mWEQEQ:oiE2Zw3K40nW87wmkiWh
False
C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate 18.59 KB MD5: b580abeb019792b8949bccafad5735f5
SHA1: cb92be2d320d8acba307fa5de693ad1f80944dea
SHA256: d1f2d99d8f99e182919aa0f966486dce09bd7c13c97b8f6fd9a5496fe787531c
SSDeep: 384:Guz0JWb0w4VO07KDfI1H8+srPZwna7rBsZmefGMxO5xug/lO:NWWb0oKK6BsrPZYa7tamnMxAxd8
False
C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[lockhelp@qq.com].gate 1.35 KB MD5: 1102c7fbf4a7812e75fe81ac28a59396
SHA1: cc3538a6e839485ca387316ab1e746303c3af344
SHA256: 21e212250c8b2a3c1dd3576faf646b475131fc4aad0e9b754969800c9b4795fd
SSDeep: 24:piS3w6HlsH0CaEhcYAwlIc7+ey9fLhVD6kDws21p/9Pb82crq2ccrWUaYDMCRYp:wSnFsaEhcmG2Qf9N662z/9Pb82crecra
False
C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 82f542daee91c0e7cfa1870e03bb66a1
SHA1: b4222f0886ff4f7cbd7da7da35282a2a8f9658a6
SHA256: 9cc70f96528623758dd8c967ebe47c5852d95ef41ddbc182c5feb697b7f9b88d
SSDeep: 24:nat9MVaVzsdyqXTKH3KS7sVWq+4WC/pw+KRbCy69yfDMCRY9:natNsdyd6S7Gi4xpw+Khw0foD
False
C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 7de549886f45b5f8180a25fa2fbcd3e6
SHA1: 3996b9e414c4b0fc230700f02463b5104ba77ec2
SHA256: 6c8de7a8edb931dee452d8763aafd4c358f487179a50b594eaeb55eb8f1b04aa
SSDeep: 24:qL2Hk/OWkciUr162kufyf33MqS580qVetJD4SKgRsgyhJDkDMCRY9:qL2E/ZxMyyUq68JVetJD4SD+VTwoD
False
C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 84.66 KB MD5: 340c3229d785439a102788bd21a0f168
SHA1: 10c0d29e0228e0eaebab87ef84c0c1c9258a72ff
SHA256: 35bda68cd1ed81d4e5d9fa92b947a5129c1d97ddc9555077000a7a0b0560ba6e
SSDeep: 1536:x0qLItBkANp7qnyb3iR1gAPn3yN0Vnepx9cFHLJwfaMV+LJr/zfgyb0TrSS4FQXf:x/LIvkopOnuM17Pn36Aux9cF9wCMVavm
False
C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.79 KB MD5: ef7ae7e6476dee527067c04e8644c976
SHA1: 8f61f49f7cb21b6c4a578ce0d23f8b68dc688d46
SHA256: 185a039075db1c6223392a5b4449cbc0208bc25ccf7616f9eb5684b8eac93df7
SSDeep: 96:L7T69B6zT9ATwRxSxdHXoUaaRqnks6luY+05Ib:fT69QT91RxudHXt/RokpluIub
False
C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 10a40918534c178e802c29639b14f238
SHA1: 800151276cd37a4b88a60ae17a4417d561f3de17
SHA256: 9ee0d8d6f0e44bbb1bf002e504eca46a0ab0d35ea4255f3b400b7bc699d9ab70
SSDeep: 24:lEpC2BgVwgESVDuwJE1SjXJDej77xTPMvDMCRY9:lsgVwgdVDw8XZej7WoD
False
C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 10.11 KB MD5: a59495f08c8050a536ed4b0893545f5b
SHA1: 3f54a3d0128ff1ba5fa436662cb9a89599f8c3d1
SHA256: adacc640667822d31b1b54b8ff2a847d81465e629101aed856a4419245d274b2
SSDeep: 192:yB3rg2u3nAUBzgwt4R+o4I/3pLmnCjoZpWWkIqsKxS5XYwRp1L0x:w3rgFtBqRFZlYpWLIYUXF1Lm
False
C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 78.43 KB MD5: 8d30f8a07bc1259214525cc8ff2ca474
SHA1: 229f5260e00f3db75079e438c9ea7b0c6fb12dab
SHA256: ae5cc929b7fdcee311e32ef9a7c9ade29274dbc68a432233de926abffa9dc061
SSDeep: 1536:3xsrEG795zfuye0WxhUkD2+qO7ytO3hqnmFnF2//OLN8Ibn+V+giLHf:hA59F/s3DjsO3YnWM/WLNb+V+J
False
C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 6.93 KB MD5: b87a7b919931fa7b74cf872a3d7f0af3
SHA1: a2fea84edb8d6bfd15beac93a922983c8a7330dd
SHA256: 82859b0e66353873308f13ae3f26b19ae21642bba47259e0ba085e0a203fa5aa
SSDeep: 192:IlWYjN+u8Xp0dlGiVi0EriEUI3q0AWMCih68VXPj:HYsDp0LJVi0Eu7G5zIhFJ
False
C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 34fe06e53d2b74c67cdd0a3c698e81b1
SHA1: 4793ecc2b1de376b320536c5b6ca52cb8d655b0e
SHA256: 2121ed54090e3d3981e10dcbcbb1cc12e558ce5ae0009f6772a773766ed4a608
SSDeep: 24:Y1DvfY43TNZPvvhUOhUYk1eZVTMPkurZvDMCRY9:Y1bY8v5tRMP/oD
False
C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 81.27 KB MD5: 96395ff5b1fdbe5254fd046832c93d49
SHA1: 56d19eaca7dc15a4dd95caa6ebadcff688047f90
SHA256: 25df0c36753cbe0829a9a9a766397dadff39539469905c351d1fb6b4e390ed51
SSDeep: 1536:k3UX4tmuZwt7QnmI0WP+cNSLo6ZGhz4HbUv1RbkMLBsEUiqi5563Y2MODwf2y:kRYuZy2FoLo6ZGVbkMLBsEtGo2b0
False
C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 813e5ab3b4b53c6dae915dfd4df2490b
SHA1: 2e97888fd49b1a875d81448b12fd60c4abef09c8
SHA256: 2820ddff4fc693e13402e1a84788c08d6e189e8a081d8b7eb629686700a32aed
SSDeep: 24:2DI7qrKChReiKmvgM6202GcFP3BPMmX6MBYwxxHj9LtQUavQO8uDMCRY9:2k2rKChReLmh6202GgvBPDzDNtcdFoD
False
C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 66.88 KB MD5: 4be020b53fb6e131316e385e04e2a498
SHA1: 0ebc6ad3581ae004cf5fe2ee90ce95cf117e1b8c
SHA256: 878992809a48132fcbfe44a5315d1196673924fb4620a9cd3c488433c5f51b96
SSDeep: 768:s2p8UUuyWHbWwb7kg3ZzDVzxIVMSY5K2AjCNl4ugThKR6IutF4SoMIFa6wq4D9TU:NU6awbb3dUqXmCUugE+FVoM/dD9TJ+
False
C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 2175ba55b43a340efb68e258ca6169c1
SHA1: ef343ca8cef2a77a0bfe1690d818c6f68af03c1d
SHA256: f4a9ea68b1763a70883f0d55d3fd4552a1a8d36c9d122417b72941f14113a7bd
SSDeep: 24:DHNG3PJDFYAKN1fOqiW+4EPXgfP8spfqzn4VDMCRY9:DHNGcD1fOqiz4EPuVpfqz+oD
False
C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 63.96 KB MD5: 77ecd2348d357ce2329eeae7dbdf3c8f
SHA1: d0b9cf8e13689060253eb5dc02b0556099b7d7c0
SHA256: d0b7577fd9ae10252b85958de1745eef1ff1e7644585bc95abe5b9babd14b1ea
SSDeep: 1536:nQJvPTsVz70SAf46zRFJANk617h7xX2bXbtCl:ELIz70S846ziJZh7x+RCl
False
C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.69 KB MD5: 6b9f32a1f53ddf2a4c9ee88593da17b8
SHA1: e377207155f24422f7aa0ea64fb66ead9b7ea1c3
SHA256: 71c304785531b0e849674fcbf09912fc4d23b39742e56d0dbb9012995059ec36
SSDeep: 96:mcM5a6ukkPcbkdoUtijg7lLoH7B2yYBRbU+:mcM5a6uTO9jg75obBy7
False
C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 12.61 KB MD5: c332e1c40c3e5e2a033ff9a6aea6fb62
SHA1: bbff6b21044609fe54d92cfb5d7ee57cf42947d4
SHA256: a3b2ef8f9b543e3293e88b5c236ce7e985f9257046a97fcd1dd731c03b199b36
SSDeep: 384:8+HFMum0UsR1qji3yWUjGZCv1zuGtiOscEETzZWDuZB:84FfRge/Uj0GtiOyETzE0
False
C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate 86.71 KB MD5: 31b6593d7d15a4acfba5c2133d1142d8
SHA1: a775230a4843c9eb4a1282ee6bfbe2bf38b9147f
SHA256: 94275b7553e415ddd5a7422fa8d7707cabc00bbf946ffe61f5205ae9193cdcb0
SSDeep: 1536:p4cGNyWpDIJimTkLB7L5ToDKfhU2ad/j68wtZi9xlrFVF/B35p0Tt:p4cGfKrTkLxB+2M768wt0BJpwt
False
C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 056c708923ef2cb67062cb031e219c9d
SHA1: d98ab01956b3b20e589e18c050dacf4b93ff9a46
SHA256: 35fcbe4db0d59207a7a60e664b9a80a4d02c3f374bb91f00d1aa4f8a5bcc4082
SSDeep: 24:f2V8MCeUntdV70bIRwKlGNNQeKNADI9+y/mRC43MVZVDMCRY9:G8reSd4cRw0GNANAc+443yoD
False
C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 4.18 KB MD5: 1734c80544909c5547947a8afc3914df
SHA1: 508e96ad8d8952054307d8512749fed6af5ee682
SHA256: c6e0ae5fc8a6af2f96c4bdc8f705bc315c95f6c1cdb1a24e3dc10b60af10acf1
SSDeep: 96:1bqiOGvlgIeeSIasZH5BhiHHwzh2Aug2cUwR1z3BPq:lqiRm+n5B4nwzZRpxC
False
C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.21 KB MD5: b6f880599487ec4698de01678221d779
SHA1: a12374edc6ef293bafb374c53ac9c490de1374cb
SHA256: bbe49f565faf23cf398c3035416b8a8b0399498b896ba52de085bc1820af6e95
SSDeep: 48:+5Z6nXXs1580cx4JGvQrZbQCjKqYSsOcHfFrYQ8zN5N7aoCdXKQHHLFDWRxql8:66XXc5Ju4JsAZbXKpSRg9rSfoFDWRgl8
False
C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 78.02 KB MD5: e5624006a64e71caa46968d39e75b5c3
SHA1: 8b263a82b52789a47e27821124deed7e9956a4c1
SHA256: e212d604912c0bbd608c76cc6f3d7484539aab24d12c3ba64e18510d7046eed6
SSDeep: 1536:bw4QXhM7uLNhYGorj115QxHbSkx7qdvcXz3szSqZ6Jn9:k4ChR218LiUbszSnn9
False
C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 80.69 KB MD5: c4a95256cc81ff1dd2a6a3a2ca2b2da4
SHA1: 081d567686eeb21ad14373fdba8a51bde1255658
SHA256: 41619ca30952eb22ca5cac99f49061f674e7714e3641919688eabd2437d01642
SSDeep: 1536:BGqWMUoRn5Enz/tbihGxZMBGgHg+cb4+pr0+ioXpNvW5npY0U5iJ8VUhAuoWXG:CMvnqzVbihUZMBw+cbzpr0UPuLU5i/AN
False
C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 77.69 KB MD5: d9db5a4eaed17f606cdc292c09740025
SHA1: ed098d3cf7f7b0c1610da9949cf68287aca305bc
SHA256: 1856e56e6f58d2d77f29014fe08a2f294995ea127f8e46c5cee389e86d89241f
SSDeep: 1536:oqOY/gasUg391lPMQJCNodh6l3TfpU63SmX4H1wK8SfOAnGPC306dD4ph8c:oqOYYasUg391lTJCI61Tfp73Ss4H/8SA
False
C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[lockhelp@qq.com].gate 1.35 KB MD5: 23bfd06b3dcf108d88f625e1a4260bbc
SHA1: f4aed90831085831b9b4317362b5b5769e275569
SHA256: e9b038e6b8d050624b19e536cb717a59a5735f01257b87fe6b23e1fa9a61560e
SSDeep: 24:P2qIGrkFUJ4uz/I9BF98ERsxfXdb1bnT0MmXPe4DMCRY/:P2RGrkFQ1/I59BwvTbnIM4Pe4oB
False
C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate 1.10 KB MD5: 0946fe3bd35f580b6a063b6da14cf512
SHA1: df24607cfecaff063a84c92ccb3d5d378120eead
SHA256: dd1c091cb8a9c25a8a440e0e83f2f8cdc678867a52bad87732ab35f97a7391d5
SSDeep: 24:tAFZo/FWssS8n/vuzV8W5oBATQ4upoKVqa3cDMCRY9:QZo/D82B544upPGoD
False
C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.83 KB MD5: 0809216a9df4ef48815430a31a1f8174
SHA1: baf40c22a553e07eb70f3cee9454ca07a95496f2
SHA256: 717c3d46cdbf7fab250eba3b497d57dc4eeca8e901ac12afa3a8c73ef510ad58
SSDeep: 48:3aSCNje5DiutdVxk34NULIMOG8zzbJwhGSpZHArqLPxLRP3F7GWSw5HWS3hTapHa:KAiMdnk34EIPOhfHJDZp3nJ
False
C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate 1.36 KB MD5: f19291d7ae6b5a23ea5b76db47028022
SHA1: fb1c8b91713ed4e768ca902eb5902b4fc21b0a38
SHA256: 7668560e48aa4cb291cdcc9e5324781140852dcfd7aa20d536499b861d51e6db
SSDeep: 24:UQsBDSYDKhkulTmw7Mim4dOqwVjcfEzOMR8il/hPWgIo0ptGDMCRYR:zsBDSK1atMIdGrim/7I/6ov
False
C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 79.10 KB MD5: 339c3f533718949b089f521ed93f3f8c
SHA1: eed42d962a27cdeb11d8804bdc7f287adafbac3c
SHA256: 99ddf986b29054ad1b0dd56209a5cb35902ffdbbb2bfebe40662c468917b06e7
SSDeep: 1536:qU52Ee94KnQsw/GS2BCdwz1DJcFveGVvM9hJbkwh8qcNU9Qcm9v0:IhE/+HmdM9HbK5NmNf
False
C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[lockhelp@qq.com].gate 10.13 KB MD5: 8751c2f7da3c4a8db73f8667c58e6ba9
SHA1: 75fe7671c85e023526280c6e0590b1a2d1ca368f
SHA256: a6a3aaa71121d2979580d5bf173d785bd01f2ea81965cb33da4c8b293b093c84
SSDeep: 192:IgCrh4f7ZfxPfvhTM24SnfcP8XymucjrvsXqrfpIw3GCmuK:PCruZfdVM24Sf0bmucjrvs3MVK
False
C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 53.41 KB MD5: 00fafafae8ec1ab405f6ed7224cc6915
SHA1: 8c615e7b941e7849f8403857dfecc9b4dedbd4e6
SHA256: 7c442f8c424b27f5e87b02419d53a83f0c561c7bff910693d8452c11495e7e31
SSDeep: 1536:39bKhfqsHJQIfvw7YsH4TtrbYBPhVks5Pg:39mhDJQR7YsyZUhVpPg
False
C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[lockhelp@qq.com].gate 10.13 KB MD5: 099d98a507b64f852e4b2dc1a2f148ba
SHA1: ddc1820ee4e4ea3e168a43aa1ac81d677d67e082
SHA256: c729f9602f1d3b3bbfd173215064523791f548b4d282f5b740fe25404fa71283
SSDeep: 192:L41gjWjgwSr9iecK7ypDFGaJbhWjOQUnlLlHb7U6cAeujjh8Sjqgcl3JeJhz4XVZ:E1gjWjgwRhGahBNJ7U3AeHgc3JSSiK
False
C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 79.82 KB MD5: f8e90049d6796c94bc87376302f6769f
SHA1: 15554bd85d10118e86dcf4670b17589fbda842af
SHA256: 9c7db5d61022617d37f7fddc1f1c9b74e7ddaa6296f8d6065b12f3b0cd5c4478
SSDeep: 1536:sbXf3XhK7P26yGQxFdTDTHLDPW8Bp67spfi4Hy1q5UG9f3qBsa:sbXfCO6yGQxFdzHLDdp6k6iyw5UG9fc
False
C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 76.12 KB MD5: 65046dd28c114fb05a3d0676cc42b615
SHA1: 78fdf1e9461e8d7e363cb05a564567c549182f65
SHA256: 671aedf44a0b8d92e9e67e7778785ace9021782776f9f50c595d6b6bbb96d345
SSDeep: 1536:/UlbbQy80+rMqNkw2ghf6DF/TJepBhnJWLaZttJ+qOz7Nw:/U1y0+QqNTyxwpBhJEaZt/lQNw
False
C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[lockhelp@qq.com].gate 36.08 KB MD5: 80d8cca62926136f669ae48ceeb97e5a
SHA1: 74632bc890629eb0621f32eca88640a6e9756e02
SHA256: 3a11134be5444eb07ff270711302394ebc5b959643b5e3c548321063d41485a7
SSDeep: 768:Q87o6GFsU2991tVRJIsvGLMCTfWqOWKfuzgVCAdu81vXt94B6t:h79Isf991xpOLtWqOWKfuMVT1vf4w
False
C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 4.00 KB MD5: c5bbe473cf5a02ff0473223efc802f18
SHA1: cf5beec4f84ce0723280396008b34a909fa69840
SHA256: 72261a36e9674af8db0786d971336d201d18dbd7c8157f0d8dd806cd1bcd09db
SSDeep: 96:1+F+NNfi5zxrM6nCcpUYau1MCtCAJDpAHEa9Ge9qYJzmI:kF+NNqNG9u1MuAka9GYn
False
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate 1.36 KB MD5: 5d07f5d3517ad970e4a07bab9bc73f0d
SHA1: 66b4abdd71be961a1d49481bc30575bdb5ece49c
SHA256: e44997c2a9ad4fc16620bdaadbeaf8877f83b5a72ec4336edbfe45db7ba62c59
SSDeep: 24:k7AUNZnUnG3qZtbRQ48MuBogvAps0Dl/BwKKDzA8EKjhTif7gVgSDMCRYv:Vyl34t7YTvAio/mVDHEuhef7VSoR
False
C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 4.00 KB MD5: f907d49c489f796db65271972082256a
SHA1: 46e7519ead38efea7d0ac585c9e79beb1d3cb4aa
SHA256: c57c8818534e4f2d5351005371473f620ee39b6d44a9bb76044f48aad28d73bd
SSDeep: 96:0PtTzR/7WT3CiQMo85X5s+1CG+B/tMjOH:01TzQmiQMoqXW+1CG0fH
False
C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 4.14 KB MD5: 57ba1109ca16c22224380e936ea95350
SHA1: b099474a288c4761a5e7f35183148a339547445f
SHA256: bbd6188856f3b3700a688af4d5cff982e80a33b7fa715b50d0f98a3b18b6c298
SSDeep: 96:0oFadd+2UAOjVq5U9YKF5M49ZbSeo7kqhBiOcy+TN:rQddXUAOj+aYb/hUXB
False
C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 5.93 KB MD5: 3dcd45105e7f6c3856e4d3c4f7949a1d
SHA1: 562716f33a996b17ad1b5962494250c85c42aa5c
SHA256: 49f4cee759d702088166569f4ed6f733d7a2bb0b5cdbe522ee7eece0465e847e
SSDeep: 96:lehNv07Kff+fgl3q2mB4tz+xeJpXmdmGDUox1R/E9MiloWzUtwomQ2RAY:ajqnKtyeHmf8ailoLio32Rz
False
C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 75.27 KB MD5: 97e0a589bccc3c2e2c0d4dcc113c0b88
SHA1: 0f81d04d68f6368fbe794718b2ce15477865662a
SHA256: 286b499d4c0839ed3f03ecbe004e39ff6cb905dc02592b16176a57a43c7c777b
SSDeep: 1536:Uoxh8MT27T7tvUhpfwLym6aupJMkiUpv+om/PIRzT+ZJHqzHwpY:UoxyK2H7KwWmturL2DPIR3+Ztqz3
False
C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 6.39 KB MD5: 9753277e6259f162c25f8618f62495d2
SHA1: af91478065d9e917d8779d755e8bb20d5940c3cb
SHA256: fded8bf8d05edd15f97108f13dcf2d0e80e0c37e2be40f01d05871d495fc1b2a
SSDeep: 96:IdVwSspd2sayYBJ8kNWlmFV2+y3/mu0CdvjyPY9/4wgcblFzxxpNgFy7F5Jhn:FT2BTBJ1QcCJPRgqlhxxrX3n
False
C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 78.62 KB MD5: c610ff470ce3cba2c20277609d4c14cd
SHA1: aa4e3ca773fb1c827bf0da86d52336f7e152ad18
SHA256: fae27db8476f7201e5ca735342c196c407ca818813ade2f71ddd3527c6faba7b
SSDeep: 1536:1SyrDpXCwXElnMXhX9fhJDLF4Oka3D5KuIA6CTKSBgEbr:ZNXCQOMXz//F4laz5P6Obr
False
C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 59.51 KB MD5: 010b5ade73c363f901578f6188fa1fa7
SHA1: 37c6f40fa8de4cfccd9053cd34725ce56028cc45
SHA256: 1c7ba235d6d6c45b2f0fd0561114afce97061a66530dd1c8bb832caf562e8ce4
SSDeep: 1536:zB4+lxzGa0sdLnDPUetdbQKlIEmYaEJFNT7w1SS7l9LU:mI0sdLrRtdb7lIExnFNA1Pl9LU
False
C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[lockhelp@qq.com].gate 3.22 KB MD5: cbc65b70c2273bcecaba850571f0a2f6
SHA1: fd85d6de9f09b34f35903c23e63060fd6ff6a2d7
SHA256: d8e91f31e9a6803f82192f0420923088ba3352082bcf4beaffe78bea30732ebe
SSDeep: 96:yoKdB4N2ZHacIeaDpcNsM/JZs/V87r5mfueOSCEUOhSRrh:ynBK2ZH7IeqpUsAJa/V87r5mfueOS7ry
False
C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 59.65 KB MD5: 3de735a5575417c6ceffbd6e5d9bb7e9
SHA1: 0b0d5e89f9e4b21aba0d330016fe4f86eb5dfc2f
SHA256: abc78d28cd4fd144433b7ca4f4d2502a1abc6d3dd244e2575ad24ebf60b421ed
SSDeep: 1536:9qlrBIb2dcXx3vJlgr4mN+haoAbrzSlErXJqhUbD2Me:9B2cPgkhaP2lEbdD2Me
False
C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate 78.37 KB MD5: a7ea6811fadf5acd956bda6c2dd6fa19
SHA1: 0c6dec15dde42cba024a990e0ba5f285b080d5a0
SHA256: 5eeb6ef7255c74ab7ca71daeb6856276dfed52f1ccca5a0a79570eb0744b70be
SSDeep: 1536:ACIHsHdRjugCUCqcEcwr94Q1G3uXx7mWv/0krSLN77/kEsV:ACIMHjjXcW9zJH/0krSZP/kH
False
C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate 197.32 KB MD5: 724048b99a32df46e9e12d3e3ea415ae
SHA1: 1c39b7489b99fe0f16a3b9ccf41595706c57b970
SHA256: 873da579fff62361eb10910bf55eceedf50eadec0930eebfb2cff7a7759740e4
SSDeep: 6144:h+G5JClx6JpDgXyQa3lBT6ylu2JxoBQ3p1B+:75JClw7DgCQaVEwu2JxoBQ38
False
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate 91.38 KB MD5: 6c8fda456673e1914e7397ece2d00fe1
SHA1: d60eb9da29686c92c4f8a02fa8d73b1ce601dc19
SHA256: cb8ff3c56a8505c680a091b47a59e1e99e9096be170d15dbc3195eba1715b317
SSDeep: 1536:XYoo7+dUaEM++teccWDnW2DrheUpijJxhzbBXOy42P2075SV0XSGQRTr3o2lz:X5E+dlEMrtLnW2qPvZO00S+T7oQz
False
C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[lockhelp@qq.com].gate 15.99 KB MD5: 962c8590499b074266eb35868302f89f
SHA1: 7207838830e30c6a3a44231c1ef7b02c29124c20
SHA256: 7604f4c590269f583e150530fe60e40acc5c3ed2932e947635e0f44243f08070
SSDeep: 384:wETISJUSIryMoZgwnx0pxkb9zbxfCN/wA:pIzSIuhZvxpb9tvA
False
C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate 38.37 KB MD5: 9a3c1b01b063440099b5f129c295aefa
SHA1: 9501de83cd57c7acb383d6fe29e735b40bdd1eb6
SHA256: db6ba1f989fe12fef2151269a81ae399c34ea3347d95f3b5d2fd199b8b8d26e0
SSDeep: 768:jrAFGmgCRjB0a5AjhMktjl4SNNA4vlF6iDnYPi0fH5hfknq:KeC7VAvxl4SC4vrNDnAfZhH
False
C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate 38.37 KB MD5: 738279f1634501e42e60d3f7bfbc7ca7
SHA1: 73abf6ca501e31615d62fc8900bc9def4d91e90f
SHA256: 17bccea0ca66d07cb581eac1e4ec3adc84cbf7d7fe1d1ce21714e9325ae2134b
SSDeep: 768:MdhihMGkJIyNL/rByV74SGWfPLQsySUMr134auqR0SGMtwTuU4JDUTn:MdhEEdA6SGWB94lqRxG4PDY
False
C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[lockhelp@qq.com].gate 40.36 KB MD5: 8c351c7850de35352b7a03740102dd0f
SHA1: 502dd0cbfcea43f7359b892378af869b3fc65401
SHA256: fe6a6e30b89e36f42ebb2e53858382d8f0c1b7b89d1b557cab487129f52c260b
SSDeep: 768:QcWZ2nI/8jNGfvDnoKAh2XJRqyPSF0gMxSjAklVsYt+yNZK:QcAkNWbLAhiZPSF4uP39Q
False
C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[lockhelp@qq.com].gate 29.65 KB MD5: 6b2453a827b29904c7c7d871b9dfa2cb
SHA1: a453f67686d0c7637f0b2c5ec3ad308844eeda63
SHA256: 12603f6488cfae7e8d2a9d98532655ad1f7ea3d069568190f81a8e56a2ca76b0
SSDeep: 768:nd3z+8tsO9oooXywE2Q3UIGgJYSYl67/1bT17dkmVja:dJtv9oe2BxuVbJ3fFja
False
C:\588bce7c90097ed212\Strings.xml.id-B4197730.[lockhelp@qq.com].gate 13.99 KB MD5: 923c67da8c7334ab0164ac3635fa0ffb
SHA1: 7bbe532f9746a8c4e9e58c91c8a03c061861968a
SHA256: af46c06b229253d47bc0b678387a0efde07227393827f9667a07cd59a3d68324
SSDeep: 384:ixYpGLM2bD8S09WhuTOqqOvTf5SndqYNke8eul4d:zpGLMMDB5hqqITwkK1
False
C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate 38.23 KB MD5: 9e05900efdfcfded6e5394583c9987d3
SHA1: 239aa7da3cdd431398485fb21755d1db0714f22e
SHA256: d86387357008cd39e162e533b9ed0a9a33472d6034b42a463c752d60c282afc1
SSDeep: 768:GdI0jMXPv6DXFbEC2ZqLsj86uYsVjb/iV8o0xKMcbVp1EviC:pkWH6bFbcIeuHVjb/w0xK/Rp1EqC
False
C:\Boot\BOOTSTAT.DAT.id-B4197730.[lockhelp@qq.com].gate 64.25 KB MD5: 80d3d067b5b8f9f96733130b06eae5fe
SHA1: e1853e4a86dfe709b8f7a553b38f12934c8c86b9
SHA256: 42a3d9c5c44a94ee8ac68a16c4a242ab557e63d55b3dac7d3fb7d4e5ca6eec0a
SSDeep: 1536:z8B64LsfPHrjbWMtVGH4+qjBkkWq65ppCBWlnbvO8rXoQ:zfNjf3+eBkrRmBYvGQ
False
C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[lockhelp@qq.com].gate 1.11 MB MD5: 6bc1ba8edcbb2807c8a011ef10a40521
SHA1: 7b78c7e2dbf52918459bca2692f494c306d02712
SHA256: 21b3a7177303b0a8f87b7cc30c701d20d16a25da5bec8fcdec2022946650315e
SSDeep: 24576:mmy+rGu3M+LAJJTELMhLVICyDTecOF1UsCg0knMkMvj+OIut0BW:mm7rGKAJNbhLGCyGcOFDHn6vjqs0o
False
C:\588bce7c90097ed212\header.bmp.id-B4197730.[lockhelp@qq.com].gate 3.77 KB MD5: 9e55987de1f1fb3507bdd8352bcaec5e
SHA1: 336b2848fe38b05051007e543c845dbc0b329269
SHA256: 9cf3e3ad14e907862c782b2388ab01b2b009b923f28f1d5589402a91761d5060
SSDeep: 96:QD052leTn3h7RjVFN3IaFfRUGPfqWed2xUL:QIAl8VFRIa8GPfqWeoxS
False
C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[lockhelp@qq.com].gate 101.87 KB MD5: 22f2d04962b7b9e9b97811564dea9f7c
SHA1: 2d7a0f151785d2911a66dcff5e668d2eba84cf57
SHA256: ad4cf8d88d152e9c43f567633468362d9c46e402bc034b0427d9c42e78ef59a1
SSDeep: 3072:wOHIz3oxlk8102caoSoPCF0RCZsq1fm10:w30k+dcTSoyBH
False
C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[lockhelp@qq.com].gate 265.91 KB MD5: da48299aa1481e278f7af5873765e7ac
SHA1: 502a7e0025c13e1c575647bad13ea35298284109
SHA256: fb263a2bdeae03bdd160af3d77e8159cfc15727c1e4846a84fe9a8d58d92a9ec
SSDeep: 6144:4g9cyZG4hdPdpqqVK1jfUH43lPow/p1X9EhjnLLRRnNs:zjIsVWT1lPbEhDLLRRNs
False
C:\BOOTSECT.BAK.id-B4197730.[lockhelp@qq.com].gate 8.25 KB MD5: 780e7dbfa669c252802484177246a1fc
SHA1: 53e51ef83b3084e8b4e9482ddbedae084e08cfa1
SHA256: ac076c8a625cbc41c20d622894866b3c77c47e4e56a9d4f1672717210e6fc074
SSDeep: 192:yfXf9T1UAJFhoGKc5UvWEE0dPOh5TDqE0lN4CjbHwoNl:yvf1WACE0WEE0dPOHqE0/jTjl
False
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate 4.93 KB MD5: 1a148f9d83896d6355c79e81dedca98b
SHA1: 78c487a4862cf31b59f3ecb679afe302d42aeb6a
SHA256: bb96dffbf08733ecbe408bc7db4ce39467f2269c3e078a98cf4dde142d0d8dee
SSDeep: 96:OWjGHkWeCf/fAXlgppLwi5/iqAkOWCrZykCkrrD49Svifi8jTEBKm:OG66yW2Lr/iq/y57rrM9JvIgm
False
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate 4.62 KB MD5: 984f371fdfdaeb3c7cabb56986f7e2fb
SHA1: a985b5fe863c268b17d9584c6e6e41380336eca7
SHA256: 6af394109837eea45048353e5544199c306413d060ff2dd61218913616778148
SSDeep: 96:dLtPwZfodyBc0qK3EjO5TaP4QI3r+Q18p1xgBT83JDQHjcz:bIfNBcnK3bS0zdJaV4jcz
False
C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate 2.56 MB MD5: 5f9ff6c5bf092ba9d38b4564b994b91e
SHA1: 1b854b4ad824c69ff4d35e862f0070c6e24cad10
SHA256: 45b3885c1c12acb2290af10504a013b0cd25cce69c5c8fea0a24e5e039be94e3
SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGxzfxmd5u04tncVKKpzDBOjiB6RlsjELU:ncxisfQxoMLhmqVWfQH8j
False
C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[lockhelp@qq.com].gate 484.27 KB MD5: d8feb315b50a621f4067c5372cebae3a
SHA1: d33af4a12a650e8a94ed4e30daf1291aca675802
SHA256: a073321f3660d2bcb9277b78432bd5835ba310fcdc26f927a6379da3040c59d2
SSDeep: 12288:xP/NcQL9u/qmbrTKsmOMf4swgLFh4L4rSkQZa:PLo/LTKkaWu74Xno
False
C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[lockhelp@qq.com].gate 852.27 KB MD5: 53af11dd12b1cb4689524f0676d72aa0
SHA1: b27ebc065fe6bedefcf5798af63f331a236ceb54
SHA256: 877a7a774c2d1a79b356556282d20da4e59c3ca1b62229696714e2952199af8c
SSDeep: 12288:PMEr9fgtJvalLutYcESI/L49by1iF2VQH2+fgk9B4AdJrricWf+qfUmKyuHA5:PMmNoCwtYkyigwd9ridGqVcH0
False
C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[lockhelp@qq.com].gate 92.75 KB MD5: 0b70c7802d6f25252152ccc6e895dd54
SHA1: 54cf7db02adb5cfdda6d206b7cb74ce3416850fb
SHA256: 3649ed8e777bdff5acf096564bb2d6777d67d035db7fd82a55d2b59ff207b91c
SSDeep: 1536:ALNRHRIMR5L94vltPt2Mmx4rdPU3pt7arHD8I9LeBmhAMIi+c/pXsybQurAWyGWG:2HRIMR5SvRmx4wpsUI9LeIiMIidOybQi
False
C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[lockhelp@qq.com].gate 180.75 KB MD5: c2aeadb080e3037d2d0874dcd8722276
SHA1: 302f765ca46617636c575502e57643ec3fbe3e67
SHA256: 97932699a9a5f6aa2814a2940478c01f95ae6c57bc726e55d3f360f6c6412317
SSDeep: 3072:KB37Jr3XwO4ys81FaJYFt9AK/yTHsL05BYKlI2sprfQvE2DnLbuhHQMzsOnVdLAV:oLtgORsZyFnaTHsiD/mrfsDHg/zsCVdI
False
C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[lockhelp@qq.com].gate 288.57 KB MD5: ea356e283db41d87c17ba231382fbd04
SHA1: 9e124907ceff33d9b175ae124aea605290ea6b58
SHA256: 081d91892c51db293488ffc950e423e7306a989471c43d3673e28bd04158a5c4
SSDeep: 6144:gL8wuDXw3EMzg4sZNzPlszuWfQjbJcp79tit6gEikA7f/qw:gL8wuzwUi9SzPlm8buIOikAGw
False
C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[lockhelp@qq.com].gate 94.08 KB MD5: 37b5591f9f354418c8f2c397cf1f8bf1
SHA1: 5ef34a8795619901c4492405aec0dcf845404435
SHA256: 2c9062f557c506d65789a289c4df3bd294352ea1beadba9294396d5fdbf248b6
SSDeep: 1536:ZtC/z8fGky//LkoKSMT8/bVcC8uBBn8v6amxFHi5TuPMaM1tGd5Gi8SBwZsOkxQs:ZtSkGkWTk9g/CC82d26TfihaM7Gdoi8G
False
C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate 0.87 KB MD5: 41b0bd83fa900b7c5e3a5fc9f055e10a
SHA1: ec4d760bd08387f99e226d4db077ce6b77b8a371
SHA256: 299cbd215af6e7feb251233937e4aa0eb86715d3fee365c23227ad5035b1b1e2
SSDeep: 24:LMFb51LnAPLdfcdHpmM0QvLLK213Mpn7m8tA:LMjnCdfcvYQXPJ
False
C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[lockhelp@qq.com].gate 788.58 KB MD5: 5baff17754a04dd2e00deb05be14b2d2
SHA1: 9f7306b11b65a868664ae112a774ee00eba64a33
SHA256: d7019d7db4678569bac26111481fdf1a45bd30959867339acaf3614a2486adab
SSDeep: 12288:hcu7cR7Pfr05qhKxsZ1lgqshF73NSJHM8HL9fUSiU3HAxzEZuMT133OBcNh+3O0O:hcT9frQqhH/sAFp3GIP3Fo3O0jOF
False
C:\Program Files\desktop.ini.id-B4197730.[lockhelp@qq.com].gate 0.40 KB MD5: efc956d2508ee45a91ed981e3f9fc43b
SHA1: 6e58272c0082eb110e33f4c5ee080c88f5ffff6b
SHA256: 46ae73de775c3c9ac82b72ea59776a7a5abd0c2a32b18645ae409d17fd0826bc
SSDeep: 6:WVz/jR30PahotojYtwEpCRGPPvESEli6WCgxLfGWtrnBreYHSzyd0e9My7viSsiJ:QJ30Pa7ktxpulp4ZMyd03MKSsq
False
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[lockhelp@qq.com].gate 8.62 KB MD5: c0023ae3742d24e2cc1694917c084b8a
SHA1: dce158ab9c11f8fa290eeec4461cb407f3f091a4
SHA256: f048bc5266a83f4277d23cfd69e2d930e06c8ef681370f753c4e4412b068f3c3
SSDeep: 192:T32vXL48lO2i8FPxVH8EmgYviFgI3VMd/P1OCw/OvGOe+:i48lO274EmgYbI3IdOCw/OvGt+
False
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate 14.06 KB MD5: 62f3a6cc1c27e0c8a8c4b47b3a3dd32a
SHA1: d40a13e0d20f1871d0e6440978c11923e24b055b
SHA256: cc2447c694dd1491275c425aa2f357b8990109d9ce0d587d10c3d9fb63c83e77
SSDeep: 384:I3DR/SXuiIBPS0Q6gFjcpX7oWicimRYq8b5UfiBzR:Y1/9iWS0Q6a4X7BiFS8bFRR
False
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate 15.15 KB MD5: 0bfe28d3b71747f4bb560c588ca39e9f
SHA1: 1f5821725d30bcc8042d02223b3c1ae447ec4453
SHA256: 92e5d856d21da7901d41d9f6e2622bf9bf103348487359f55d4f3463ee619774
SSDeep: 384:1i0LHawZZqXKucNORU8x/F8ccxJZcwrb9d+GUy1q/qxz8:U0rrqXTco9f8VZcwrbv+GUyM/qxA
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.39 KB MD5: 9912cedc806c815ad06f3907066eadb0
SHA1: 8b46ea385de96ba56567772a982e74076b86de9b
SHA256: 771b1e8a9ef5223de84494c9f7ee73337aa4fd3abaede69fd2c9dcbe76346770
SSDeep: 6:yzx5kByRuJ7LkSPZRmQ1LCda9fy1iiMvnOClexLf/12krnBreYHSzyd0e9My7vi+:yz/kByY/RxCY9K15Mf89Cyd03MKSss
False
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate 1.62 KB MD5: 65a570961a16efcdbd7f805e7e3d2c45
SHA1: 57b62a602fdef77e3838226e1150cdf660bad2cf
SHA256: c290dfb0ec909387aa500e0e5008223838143210d5e6bf7abee6fbd23d8214de
SSDeep: 24:HJO6/vog170bdvbh6dy0uvBrXwwEdTk/tDVakdVf2wWqiUe3jm8ta:pf/vvNkDhz7ZwwkYDVa6Vf2wtiUYS
False
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate 7.87 KB MD5: 98796df332b7b29b169037ae255c36e4
SHA1: d831151cde3911329746555e778c3502f1ae1126
SHA256: 4abc0c7e8bd1e59e462a43c9d66f8b9d649781a9dcd4f28034ba9c5fd6b91d60
SSDeep: 192:x+rEcGGoGX0ISwOE1FnWUFrjmUiaw7/rTCcyPLK:x+rEcGG9X0yL18Wjt+rT0zK
False
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate 12.21 KB MD5: d5f2a778b13ef045901686126bb13c89
SHA1: bc29a4b8b4247ef5d63158b6ff0b6e98a4aa6e91
SHA256: 17c1dd667e27af63ef73a0aaa54fa13ec842d7f024ff27e31db09a09ce786328
SSDeep: 384:mHaPt4KgYxQDbYu/TT1JhF2Boatvk3bnKPGuKs:LO39vLrhF2B5vk3bKPGuKs
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.41 KB MD5: 60781ddca91e101a36665c5c63d161b3
SHA1: 23d9a6167b95bffaf360b2a298153d2bec91637c
SHA256: 73deb1882664f14e50da09b4a28ffa83e71cd121a06dbb9d46c6be9d5d8bbdd7
SSDeep: 6:LU57Fpy40qM19FKhiO1lCZ+Ktlcp3CDb5nOClexLfvRT4y3UrnBreYHSzyd0e9M6:k7D0K4OLa+t30b58vRTDdyd03MKSsG
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.42 KB MD5: ee919e1375b0c2d802ed35f5e2a5673b
SHA1: f657b3328b54c4a1d68987fbd05853c0305497f9
SHA256: bb0b3c78c11d29934e3ed5f45572d875ff9129b372e7aefdcf839177eca3adf9
SSDeep: 12:+tpcNZmMWwJU7EARS30a8rR7tyd03MKSsy:+tpcNYvBZTR7tm8t4
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.41 KB MD5: 89d42a1b5ae3fb297878c8740d02d793
SHA1: 046b55ef566c7d124c238f85ba8140a437d9ca25
SHA256: 6ff0cfb7cdbdaa3512bfd22d74bf8f14e7e92974b3ec3309e58155e6858b2dc8
SSDeep: 6:wD4PxKw2HmGEfR28t2Xxacp3zlp5nOClexLfTVrnBreYHSzyd0e9My7viSsi9:o5ofRaxaq3H58Ayd03MKSsG
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.41 KB MD5: d5d3de30eb987e445491ffdece1028cc
SHA1: ae585daf6090e1480d72305048f03902913d3fd1
SHA256: 861e6f006878f4247b92e7d81f2473c9d373f8d3eb04ac787677f1c41a19e464
SSDeep: 6:jo9fszMnd8uO8wZk/5juujf/CTwnp3SnOClexLfJCo8rnBreYHSzyd0e9My7viSp:joi4nda8saSujfq8p3q8vyd03MKSsy
False
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate 4.37 KB MD5: 622095e964866e4cc0e2410aa7b15e92
SHA1: 46df46524459af50574e7951e8b51462fff299b6
SHA256: 56aa29912fa7e68b8c8a2e9b3421b77876cf1d21708818619a6b1e649e007482
SSDeep: 96:O+gkfJfUTW41veWQtj4ZosCiTciqMJjR5QhVBBz5Oya1CS/3LfJDvI+AzX8:O1kMWBWQtjSCUQ6R5YVrz5OyaI29DvIk
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.41 KB MD5: d414f1fd321197aac0e270abd76f85ec
SHA1: 331f0b0c779596b27d758d122162884c78dfd8ca
SHA256: 8f2057a6c7a2854de2db4748539476c710fc04368b4b24de953ef5bb8eaef7e8
SSDeep: 6:OJ2Ck1v92y1Ewet0TxvSADn6uMM340Up3vT5nOClexLfbFlOrnBreYHSzyd0e9M6:22Ckr2y19UG1Ib3vT58Zljyd03MKSsG
False
C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[lockhelp@qq.com].gate 0.27 KB MD5: eaed1052442c2e66af2582ca45d823de
SHA1: f76b32b504c0dfd5b1f83cde1208b72c7f5059db
SHA256: d6959a74de976c3ac2ee727874ded09af407b7847ef7771a2aaf28540a0c582d
SSDeep: 6:OHSVx8lCGn/lcprnxLfxJnlkrnBreYHSzyd0e9My7viSsiH:lx6CC/lSVzyd03MKSsQ
False
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate 0.42 KB MD5: fecada5bd6d19ea4407ce98d15bbe722
SHA1: b00caa8441aea6d711e735d87f11394f6699f165
SHA256: 19b80025d072f0e493021701b783bdf9d570124d8475731a6d6e2d1be24eac3a
SSDeep: 6:2pMAqyohgkGHL1BTEXZMN7kWPXsp3zlUnOClexLf5X/WrnBreYHSzyd0e9My7vi4:Y5Dohu1pEXWZJXa3O85X/Lyd03MKSsy
False
C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[lockhelp@qq.com].gate 1.17 KB MD5: cb7bbe5c115265f9313512d28764533c
SHA1: e43a662999334ed5e13fc6e4464f6f8caf0f82d7
SHA256: aad6e610f600284902c6a489b8eb44f76c0006db13c4de75777e159a3367dd18
SSDeep: 24:17pbpLDWlCTqE7NA2+/2NXtNtGZR5q65R/m8tW:171p3TqgA2K2Ftn2R5q65g
False
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate 142.04 KB MD5: fbd84ab48d167c8f816e6762af1a1f20
SHA1: 6833a0adb7924f1f146f502ee4976f4f9058ee52
SHA256: a293706014aef4cb2d4a73bdd2498d4d83a826346d6cb1f58a9b3f4c1f635bc9
SSDeep: 3072:hRf129YrAZWs2fhWJLyaFxNihDpM4oxJHinRGkXgBoT0206KLZbSX:bfo83ULJizlo3HYRGkXgBoTW6HX
False
C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate 0.53 KB MD5: d1deb8ea3bcb9c9d14d939bbd2ffc6eb
SHA1: 8e6ca20bf4ed5b947904ea8e990cdae990cd3cf8
SHA256: 4dfdb02dbb073fd9c1693f24eafb79be597410ac1e03ade57a6f441a28d3bf11
SSDeep: 12:wrnKRJ4COepWmRb/N0u2itfFIDdjc1jIRN9tjyd03MKSsY:yI4+cgC+2mknm8tS
False
C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[lockhelp@qq.com].gate 141.27 KB MD5: 6aa68e96552046a71ad94267b40082c8
SHA1: b6731a968917a9c358f216b070796fa5c3567cbb
SHA256: 873dd6c10c0f71ec1c585f583916d5607dbea699f4fb333ddd117323cccc75f7
SSDeep: 3072:LTe67IcZwkpiRjghDlz6QVDCzi+aeSUEfZYnPOHP/pK5gJ4eVbfre:G67I9GhDl2Qoye7EfZYnPOH57rhTe
False
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate 62.71 KB MD5: 03bfc69ba04c7e17eeb58f8029e69608
SHA1: 9121d09d56dafb18de8bd46c355dcf00b94c7dd3
SHA256: 75ab365271ba9c35ff11b19fbb0450bc7963e0ea3a893b9eca282e016e47cec5
SSDeep: 1536:WEc0mcUnl/62R3OD3ZqCAPmIIa+rg4l8t2jpx7oyE:WKzEZGgYg7t2jpNS
False
C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate 92.49 KB MD5: b63cb5d62ff51ade2c2f36363479d334
SHA1: dae8c48e3d5063aa06e4012364cce29b17bcf6d7
SHA256: ae5a2436584efd13438509919b5ee44e154e05e1c9f99e27a42fa05ce9837c15
SSDeep: 1536:TkPOd8xPtqvT1BFv6r51mcAz2Ia6GZlmw9KGu4xBaTqmNhUuNgmb9vscD0U0:oPOWkvb01Wzj5GZACKGD/4X+uzbJF45
False
C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate 35.73 KB MD5: ded0d199c4dbcaaf1a964934d589affb
SHA1: 09ff33fdf4e15bd2bd44645b7b7bc7152862e99e
SHA256: feb0caeff1884ccd73deb222ad02573bddee4478b328620a4b6a07812c516547
SSDeep: 768:0mDO5QXMatzP2Y4CyNpYzrv+M9s0OCdPRV0xvFuOogbEyyDpd:18YPHypwrFuCdw5oEFydd
False
C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate 170.68 KB MD5: dbdef473746947aa44f0b120b38e7c9b
SHA1: ed326abd7c725c616e8c39dfb81fc5484955f362
SHA256: 74f670f5df0d155b4a4c657c6a8e6e50091e70330f9ea21c7c354737b510cf57
SSDeep: 3072:4zKamRzeWnXrzH4FQXGRtxCLXGsphLww+Z9q:4zKakznnnYFQXGRQXGAJwhZ9q
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.81 KB MD5: 648c6c5c2e230950d910987fb661488e
SHA1: 49c98dc4f5c867cfb33260640f5b0c5c7eb04d90
SHA256: e7d760b26d4dbace18d098776d5a5a5273da94a6f6d98179291c9bc011e355b2
SSDeep: 24:Q6SuCINc8V7nGv8faxPeP0e+DFS21YNWQKJIHRMlGJvbiaDM0V1pCGCJtm8t8:Q6jCuJfBsjKNW+MQJe0V1wGCg
False
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate 5.71 MB MD5: a00e66423c658db2b89e797ad360cc68
SHA1: 63e73c5e16a4becc14344ab1ab94a13f408867fe
SHA256: a7786f1db46f429774bed90d7c12f2f9fceb8a57bd1df2c69b48441876e03348
SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKkoxoW66EAIV1:e3PBkOK2Knq45mY4H5OMKkKkoGWbS1
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 4d0dc0cce1ceaca869d1594d3c8fb738
SHA1: 476398012798aa77975cae9066561797d130f043
SHA256: 0b04bcb56364c9fb39c807cb3d22c56439dc43d1b262285ec4b71be2d9e1d799
SSDeep: 48:m199jszinOL4iChF1d2+qvVfeniscqJ1WcaEe:89Yzl4iC5d2+qd2Hc+YTEe
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 782.42 KB MD5: 65baa7ca5615394fc4647caac73786ee
SHA1: 02befba343107e6f7d6231d83650e0fecd2dea93
SHA256: 8bb79ffce08bebf3581cc62940c536a649ced0e76d69e705c05e4427d5e15587
SSDeep: 12288:h1Hd0BUsf7zzN1hWjP5yidjwVi4Ohr12Ux8GdwI3g4RybSKg1rtN9OKkBfREs:+Tf7d1sFyidsY12UeGdqeyeQHfz
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 378.59 KB MD5: c962af583f2195792da9bde8f8fad894
SHA1: cae5b4d19345378056a45ec5d120f5758826574a
SHA256: 83dab68656da68e6d4ce3e61f3e30a9ffdec8495b05279e1974b4a9f3ed26b93
SSDeep: 6144:nhUJB+nOmJRrFzPjYYmRwt974BcM2VbVZKpyciuRqEng67KmLnVZ+iUHKq:YuzfmYm6P+rOqFiUq2Cm/+iUz
False
C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate 6.42 MB MD5: 5ca43de0b9188f65f5e20c2b3e94daa2
SHA1: 0a81594806d1c1b1a8013b0916a7c2cd557e6cf5
SHA256: ffff30f91ca5f359401484cc03647cf79e11e8d3a78bfdbbbfdd3f76291752b5
SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNST:5qk3NIX3NIIaaIRwTKREbXZIaU+qNbc
False
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate 2.84 MB MD5: f563b9cb00c41b399540e11093a4bbc9
SHA1: 62bc0f36d41a75ff0bd47a33aadbaee4ebc9c61a
SHA256: ed8ff0a0b8476f81ca42923ce6e2ded3257faf678d89a4adda36369a564104d9
SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIKHmrL7LpuBWXKkPI7plg:WV4Yab1PAdXZzKUYxs3pKZnKH+/Lp9PH
False
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate 5.61 MB MD5: 249f77192b2ac339fda9773e9d54755b
SHA1: dbfa3a25f4bd21be37dd7993c64f7ac8fcfed911
SHA256: 2b2f55eb8d856f2d446bada33f0afbbb3b98173c9056c70a5a726189b790b5f2
SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKwi+9M+:27GBHTK8KXZ4UuY1kB1iKFK/+9M+
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: ee0a2660f80fcf8f968ca22c495997e1
SHA1: 0ee5d40fa76f9ff5b025d805350529cc479f365c
SHA256: 8f3f3678a1b3621420f93d177202e838b8f86915cecaf82accebc64e6993efe3
SSDeep: 24:qxuwnK05yE5/bUHkUcXwkj9Xr0C4b8pXobXNf3gJzpACn4HklD2m8t8:mVRgyDmPcBbcb8hobpwzpdO4F
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 485.20 KB MD5: d237b7b8481180d57a594a1888ed6f16
SHA1: 97a7434ae76bb645887566f141961bb588233528
SHA256: e67d35c9d724cababf9c90979ed1a151b400ad854fd640ddbe457f91f3af1a8c
SSDeep: 12288:npcoBD7KNY6kzOxj9ezyjj3pbGRd1YHM7mdqUE5q6Kp:npcKBzOSzyjbpEYEiKw6S
False
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate 2.79 MB MD5: 039a51c923dba73b594abe75774e98f5
SHA1: b79795c24dad0371c9dae5efa6ef58b5dc7a2b42
SHA256: fc26c5611a75b2b837a782d3bbadf1556b716c8afeeff5a032f5317453593aa0
SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKOul2lS/NXnTjnJS:oJbGnRau84KUYcs31KfFKll2mtnT4
False
C:\Logs\Application.evtx.id-B4197730.[lockhelp@qq.com].gate 68.25 KB MD5: cdcd09f5ac20c6ed49632e29a9fd7676
SHA1: 769c1d00d8f2a8b336aa4307e8d560468b567eb2
SHA256: 558de15d487fbe6136af8fd5f1d2e9827351a8548524686f4f26f319192d9f41
SSDeep: 1536:h7pQrUgFme4RwpBDhhoM2IzhM+W25HpoKPgQmZTJ92e9j/n1y:hQnuaZtM+pHoagqujNy
False
C:\Logs\HardwareEvents.evtx.id-B4197730.[lockhelp@qq.com].gate 68.26 KB MD5: 5b0010d6aa7835ce26df0e49d7b2dc25
SHA1: e76437938d27421f12cf96f638cff76d4f3288c4
SHA256: a96b28256f66fa8139f590452a02214d95b8df349d665430333a2776c6332fe4
SSDeep: 1536:o5sLrVkKzcNMM3Hi/ovXn+UO1xKFJ/hAJtej4awoe:o05zcNMM3LvXnBCxirj4Se
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 248.09 KB MD5: e3d612161e6de829f85c80f3945400de
SHA1: ae887a963d84cfdb94479f05701a27454799c25f
SHA256: b361887c23c6a004c482c864c8b239c7e1daf41e429bebf6c7863a32e300264b
SSDeep: 6144:VAh3CN7qHDS3OlqkdFo0c8aWDBCR81H9g9sY3YeUUoAhyFA79:VyCN7qHqOlqebB681dg2Y3YhUoAhyFAZ
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.07 MB MD5: 3a019e8a6dae775bfefb61a5e0b055f7
SHA1: d16daf80d922d426519b02a0925f1e662e6ba197
SHA256: 291d53325452e24a423dd645bf952ef700db7b0c5ba396cc52b1a3568a3f6636
SSDeep: 24576:bwZGQn2SJKBxE32Btg5KE/9dDE99I7+yeLWnLDqIVJxMf6:bw5nxJS5BNE/9d499IaTWHVJxMi
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 19.31 KB MD5: c7afb5e91826a32551f5224dde413241
SHA1: 2f918c9945bb5333f3a541ec0c2a09f49c568230
SHA256: 01f04c6805fa25d4671ef650f976b47b98ba113bc757a01583fa67b87985c095
SSDeep: 384:gFTH4lsnh+KFlWuTks8mNJdWhiUiDCG8PdNYRrwk9GPIaR5F35I:gFLIeECWr0dW7iGGAq/GbR5F35I
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 3af7facd050009d93798fad051dce6ce
SHA1: 59b0cc6c44845799304ca0a6fbe4f5ca4691d411
SHA256: b3b864a7996472e54b229a5aedb931bb6d5c24c045646af83697f46540444510
SSDeep: 24:7zfYXnqboIUTGtWQlsxlFhTnM/yzaBUYOAR7UNJNu6WXdbOwYEkRuB6y3m8t8:77Y6bk9QlAntzKUZAR7svu6xwYBhj
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 3cc8558ceece490b63d1a42269e9ff62
SHA1: d5c90f9d2bc6c4bfad8717ddffd5b658320adf02
SHA256: fb71742410b800224303c72b6aa2327ee1300d85e427447890c89d6b9182f8ea
SSDeep: 24:Dql+Usb3LLh4/Bivxoq09YP3Yk0xhmyBdBCnEA2jdf8UpXJYOBPUvUm8t8:DWPsbZvuwPIfbmycEA8CU5e0c
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 745.79 KB MD5: 9f8ceb0077bc01fe0c17bc71aa8a570a
SHA1: 6994c99fc3812140663074e164ad0afa35761a22
SHA256: f311e25c86d42ed833efe6fffd167aab9615001e23be8e7c249c09873c55fef7
SSDeep: 12288:sUFc8VaKMtvMqHZ421IF/26lImnmlQY3ekE3Wqjoy9Kb+8+0NLAursIBneKt36oJ:sUFF6MKZhIFunmnSeNjolvLAuoIFh6oJ
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 2.42 KB MD5: 4f84f94eb594ac8b1bbe987744484ee5
SHA1: 7d7045c7a9a79ba16a7e15045431f9cb156157ac
SHA256: 1a5399cb662c4872b4db6f808fb1187cd4ac010351884fea0a5e5992897ea0e4
SSDeep: 48:6x01XhkVy2kjAsY336HMR4fDLhrPSCtYoU2OlILz9NO5+:x1ROy2cAsY336HTnhsoU2Ti5+
False
C:\Logs\Key Management Service.evtx.id-B4197730.[lockhelp@qq.com].gate 68.28 KB MD5: 4e5ec7fef5ea05c4496af3935c8d7612
SHA1: c9a6aaa944c97e703380545291831c19cf185882
SHA256: 123e724698c44ad2265eb947a4ebc92449bd4c471d0c8b71cbfd9752c057e327
SSDeep: 1536:NEIJKJJ7FO/GgmjrsMO1LK/kK2K+IYxtql2pHbcWQ5G9u:xkJ7g/GgXMO8/kK2x7xcgxQWQ5GQ
False
C:\Logs\Internet Explorer.evtx.id-B4197730.[lockhelp@qq.com].gate 68.27 KB MD5: ebe430385d2f73a3b0049cc0c9be17bf
SHA1: 403a4353e533e731c81bc3bd53fb81e82fee165d
SHA256: 5b5390a125fe49a95397da97f0860c7f58bbf2eadf7e65b4003d82f3663c4396
SSDeep: 1536:zoqL1Nh0AZkxUav/rF2oB+hnChS5yzDKrAp:7XhV+Gav/rFonChSuKQ
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 05497355d2c4819647dd690fe9c77e82
SHA1: b319e48ba1ff2ce7ec1c006e3b19b0ea170654b5
SHA256: c7b656d99ecc216540216d0b3ea1c5ca44279f06a0d4b5e4599e85f5bbd12f12
SSDeep: 24:tJfEb5pfMM2u4uYTwuEYio4AEfsVkqIu3lq2z1npn7FeIxNcvPh1m8t8:7fo5pfyA6wLYiwgsVPqI8mcvI
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 2.42 KB MD5: a5895da0a5340e3de1b66e87f2ede8a1
SHA1: e2335ee4156043b0b7f02e6bc93e3f11c154a417
SHA256: da43af1af4800aebd3d4af9f2732e306812698d08f73f081cd7d77a3466a0ec6
SSDeep: 24:Gpdb5WyUbbc0icJ0IzpBz8fErPAUrQ7cxZvBjn+DGAD2Y+6Y6Jrjmoel3lwBlZY5:FJliu1dBI2QwxT7+v2P3Ee0/+z
False
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 5d67d5ccb5f7d6a8dcdfd3f372484ccf
SHA1: 1145f3cdc2cfb03163d842e51033394ecede48b9
SHA256: ab3845d0afd971223fb9d4af2fa18b30ded61f6fa6b83ae1f7a4f21ffee58536
SSDeep: 1536:2dU0tdw4rLolVtRG6a32NVSbyVGBkJjxv7PeoNPopLx:2d9tdfMVu6o2NwbSNJBNNQpLx
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: e54ae438b0205110295cce9963068804
SHA1: bf1de6fe8a03a9399b546f847391e7077cace6c4
SHA256: 47ed56024d3b1bfd0eb9d482a2cc0c73b025951edef173df6434f5edf1af306f
SSDeep: 24:txTXZNcuMFDUiW/is/1eZ4DGQI94Lis42GlH+4NYPKi6YGdFa+OBCkcfm8t8:txTXqRQ9eUGQI9roDZi9kL
False
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[lockhelp@qq.com].gate 68.38 KB MD5: 566da4ee9956676eb965eaa24aad58dc
SHA1: 4cdbd658f8a6902f8957863eb2b84befdca2e054
SHA256: 5cc44416f592c7e96a18e1fb82f18742db578310d5a5bb6130d00eaf51a84680
SSDeep: 1536:4WsYRxIRVSlRAn1NjzjU0fj9vRi01GRg7oYIfLsHqbAlq6s:nLI3Y+n1NfjRxvJ1GSIfI7q6s
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 14.89 KB MD5: dbc40a5378c0420ab36d04bde7892e09
SHA1: b6b8f792535f60a40f3d60b0324cdded8e0f144b
SHA256: 715879520258823265ed1c2cca3902270f68f5889b0e8725cb979bd77c905c6a
SSDeep: 384:aU3LHB6yjicaOMxfdG8Fw1tjXOPK1CmIvR:lbHsCifpZdGow1tjpIp
False
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 5a0cd3d965ffc6fb36685b3a79386430
SHA1: a11613341b0d6870bb9e046de8d038c4a5986df5
SHA256: b0751816d201b5d668b731864985695788c30e082ffc08e269131cb1b5f3a56f
SSDeep: 1536:ffhI9DhyCyunlfMu0TI20luzL4RangTSDyY06f1ozDUjJeA8XCGSL30V:XaBcud0tIq4RangTSmmcDUxjDrK
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 349.29 KB MD5: c885df87813ac3017be19ab181061a24
SHA1: 757a0ccf16eba1e0b09c3eab2ea0329279800ee4
SHA256: b16027808a767393bbb13269fa46a8dcf0101a196e9eba88719172310a39fe5d
SSDeep: 6144:4e29JrI7LeQswkgO2pjL3KT+kiiFjT9gjD7Hv/6dZBR0Rfs8aa5L0OOu5tzbdU2:6JuKkkt213Rkiij2H6dZBRqZ9iOz5tzn
False
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: cc9f520fd070fd93f445b223bcffadf3
SHA1: b9d5e4c29fab345e05849b3228153b14c909fc1b
SHA256: 3840679d99df2c058aedec80f01cdf56cfadef8896a2749bd18c8498c8a7c3cd
SSDeep: 1536:lwiwK374g+/IzzkGp5EW+Q8q41hAascgQbQP0mY3tWlkGobz7:lfhC/izJuW+Q8r1+MdmY3tbz7
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 211.14 KB MD5: 507d132df57e5afbb425f4b4b109bc9b
SHA1: 924d3fccefb17f8e589602729ca76f19f918439e
SHA256: 6926cc7f98e73e33cc55a762b7bea538a30ed7b7419bd5dbc24a16a965140206
SSDeep: 3072:Uoa3crZ8GH7Ou3djxw0j9rdGsXoqyaJDnnO70Gv+yvLxusnRy/LuB3z0GZI01ZqY:L8GHCEy0jPGxuLODH6uB3vZlf
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: b0286a79a2f7d210fb7d613bea15c412
SHA1: 326be165db11ee4b5af167eeeb976948ef2e1a5e
SHA256: d81a867a1fe7065073183da4f1c83fb89cac3192f79dbea108495c9f98bbe422
SSDeep: 24:bzxfXKJUn5GPt8pXq1KvNBNLoadfq2rO0W9sUeBcYkPE0wyNM/zeelIrm8t8:v9XevtYEKvNBNLoH21ubYvF/zDIM
False
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: 8801fc6900a9beef6bef162ac8154fe5
SHA1: 5ed4030fdcc256cc2a735710ee9adeb4e7c88c32
SHA256: 790c7c5fe585e6f51891bdfb17687f8b1a7ac8ba04e18f9baa0d0eae0fc4ff53
SSDeep: 1536:vN0w6JE0zydCa4BagfEIoxNAXKcvHjSs0XhDTjUpVmER2uv:vN01gdQBtf2/cfOlXFHUp2a
False
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 1fcff7ff7b9c6a107cc4427db56abf10
SHA1: 49b36905ca5e83d25e069eb9128f3ca6caef448d
SHA256: 1bc32d45963cb6a409d84f1d7c37b5fe0696916331200c4c9ed5fd19bd1ec40d
SSDeep: 1536:yzcENIvzg9iFGKzVrjDRezMiHlsT1g/6RtB088Zz8Rv4+1aUb7IO2MJGCVIa:yznGKiFjVnD2Mg/6GlZzi4vU/IO2MB
False
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: d848c7965e4bc17a7412cdedc9b888e0
SHA1: 52d92d61b754457eb7cc375b82fd51f88b436ee5
SHA256: 036767bd62f5c592e27a887a38c12584558e9db4719addd3b0e79036ea46020e
SSDeep: 24576:RT65L3b9Nu4woWhOSLxcod/nkb+9cFfWA6NJiCR2NqZ4:RT6h3bXwxhlco9nkzKNoHqO
False
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 9bc758ffd311b9ba7876ee95a0bcc68a
SHA1: 21411b463bed11fd9252c5fdf32577a723fcfc36
SHA256: c3123756bdc12d22fb1beb4a46c76ac87829e7f9a61976c0908a077d09aab39a
SSDeep: 1536:2xMHJAkQUXuYwzCkyV7Lj8xm77VczXm23oX0mNQv4:uMHJFQJNOF7Loxm77+K23oJ04
False
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 9ec52c5cbd999aeae0564226547842cc
SHA1: f108a8122cd3e255d05c1f7fd334aaf574b91417
SHA256: 2988a88ea512b11a9921c36e0f9cf954bf0a8fc74ca9b69d728dd593467d336b
SSDeep: 1536:MXsx0UZldtwD394bL53fVIpBZByx6DnKLDgupiIKBRi5z:LyUZldaTiRfVIp/BW8KL8uUIKPQ
False
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 7c7e09edbb5f2de63c1616e587c3da39
SHA1: e3b92f3e79d68a54215e042072806a0b530be7d3
SHA256: e9d69c1545b1214f6deb7eb2fe200f64d4006845126ae09033bbeb0f99a9e104
SSDeep: 1536:SxNb24TJ6qgu3I+jDV5l24OBBOSdRVa2J2umw:61VG+jxq4OBZ4+20
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 335.61 KB MD5: 19043e10bebe7ac4c8b4c24378894b09
SHA1: 75db74e9981fb10027ecbe526abaa2b704373d91
SHA256: b79a754b8f87c16f6203f7fd0b378d0b43770b1d2152a3bdd90fdfdb94c8a3c3
SSDeep: 6144:EJo5ZC3nKG0TUrjgscnz0KPt6gE8v8Hmo1DKNPjED0rf/rciZ5NmUv6WKW:E25UBqmjgsczECehKzL/b7QUnKW
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: fd027c7954fb2387410eff9e07c1c071
SHA1: 005ea1996836c03e8da2e1f083493dd48693fa9a
SHA256: 39be6e270de8dab16dfe30b88cc117e058f4db5b67c115739fb08caa4f8b1f40
SSDeep: 24:/mMzSfjJzV7iiW03X0UHmcgokdiaH6+Ht5TVRhZXz/MxN3ayjSFm8t8:/mMmZo4XdIX7tfRfrsa4z
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 849a35b662f4467533b121e998365d23
SHA1: 09da29383b7e0eb36d56e22aa75808ea0a284951
SHA256: 4f1985a8ff4a1a77502410343e4fd60c9a64f5367098112d6c4f0dde9a2141e0
SSDeep: 24:a9oNx9KXVKLMZLZRzZZmSsQG3NNeMATDosNgkqJFEmeao0VlNMnSnsm8t8:vKXALgnzZZ7mdgMATDo3ZJFSSn7
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 63.79 KB MD5: 3faef733a6977656a674dc30e89d1647
SHA1: 899fbc615e6d222e1985d6f23fc6396c85e55641
SHA256: de2e8136dc1a41bfaa86cece459ba9d1ccae14a62956b7df519b82e43e92dd94
SSDeep: 1536:KCGaKsUVSgFSz8NMMIDVjbpPnCr1UMwM2hqI7gweAtdOCluL1T:KCGa7UVuiMtDVxCCMwTcQVeAtdOx9
False
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 2.82 MB MD5: 6d1e1b90596e53eeabf8276ad6fb3244
SHA1: f381343f28d8d2433574cef5af151fba234e38d4
SHA256: af7a42afd0abc7c7efbe65aefe1e6d0e3689c06ac542394064b145ded490c0bc
SSDeep: 12288:6528EuEaK6Ziv1dplxgM/e/hijSdo+tT8z3x/iP25hSyOr7L/whMe6q7T5:658jYQNdFVe/hKYHuzliPOSr/TXm
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 6c4e68b3ae824acc7977af5300d93914
SHA1: 45595859fa884709e8984930df31536587e4af69
SHA256: 0ee3242eaaa37b643969bbdbb7caea8f52757e92d1bbc5fef2d52d782d7157bf
SSDeep: 48:o1mtJnXShqccngxNuZk+WErmxiab4XYAxeP/yaR3u8b:o0tJaD/xNuKjErnaIC/Y2
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 2e88addd6afac6abcb65b95b0f8980c6
SHA1: 79b3f76aeef1329f9ee75355120f09140ee89781
SHA256: 203a18ce6bf1c4e68504f5096b9ef84f023603551fc3f5622edf415ff0f95821
SSDeep: 48:FzmQzhT+4vWHs5ZUAFrSgwemb3o2vElGKS:FzmQp+iXUAFrxJM38BS
False
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: 8f67964ab985714b87a8fefbdb86d0e9
SHA1: 97d885aaa5c2d5574b0d856cd371af6723929253
SHA256: 713959a181d3c8c8f5e94cef7f205cb0862ad261038689988548110f78f1685a
SSDeep: 1536:a88m0dcbITC+mVoiuhO9vGFgeSJMkuMqXVy/C554Mt5IkIY:ae0CkQoiuE9vqSJMkuMAEC55bIBY
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 390.48 KB MD5: b4c8e8a65147d0be053074e978850b5b
SHA1: 46944cb2f096a994ac6216825246ca52632e94b5
SHA256: 735fb3dab3f6cf006e4ecbc6e91c63521f2ffe5b9a7930fca28efa847217c453
SSDeep: 12288:7LIqwI7Br9VmmhaJogKg2SR4bjNokHEwjWQk1AA:7LIFI9r9VFh6og7R2NhEwiQk1AA
False
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 1.07 MB MD5: 4ebc6d953046453f3a085773b4376671
SHA1: f131e3c7cdf95c235a04cba376a5ff207f787f50
SHA256: 66fe9f691709561cafc99ab7831ccf58517c9d7bae566ba154329d83526056ae
SSDeep: 24576:Q+1YblMRsUvZFcpfSyXFnEjAoDdij6DLzGKMPITe7b31oi6431:rYbKvjhAoxraKMPITef1oT+1
False
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.35 KB MD5: 874f61d3694c2a49f67daed9776da6b5
SHA1: 4397211503d9db2b636cf2e4698a260ee0372bd8
SHA256: 4114e4a65edce12b3a01a2283a79f766429bccc459215fb56e0fdb97f17449d8
SSDeep: 1536:L0ixu2YdFa1enwN2Ma0o8gOM7CxmhgNtuR6QgciMzgOC/g8DTFPq3ZKhe:L0ic2w/nMLplxmhgNAR6jV5s3Zse
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.73 KB MD5: 85e0efa7f8d47a5ce347c0e72ac6c545
SHA1: 767a2c7be3925af8144a698e450a7336c3985561
SHA256: 045b0e25bebe44fa96c11c6f2b3601013c753d9b89636141738e656f8fced985
SSDeep: 48:FylxDOlToiPpXxWraBaqo+gfMdbwaltY+EdZFmzyE:cTCq6pXjEqEaltQZS5
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 1.54 KB MD5: cc2e55d28040c0ef8bb72401d21ec2cf
SHA1: d00994c294460f5191542d918baba4597a0d5d8c
SHA256: 174b76d6449ab467943e11d220883d2a4816f0ee90a3a019b1a87432ba8df53c
SSDeep: 24:saecHDJ+waLjoY5z2BI0qNBDT9gOvTzcgL6eIYqIOqpY5mCFWXZhm8t8:5znU0y/bnGOvkgL6eIYpOYY5ZWXo
False
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate 9.33 KB MD5: 4d20f4af341e37630de41b57f9c2470c
SHA1: 91410e605f780f76742b7a07cf64ea295215ba07
SHA256: 4478e62b8aa8d91adb9dd51f23ed3ea81128dbb7d459d1efa03d7d253ef739d9
SSDeep: 192:z4urTRBsHVdjTo0+ygn4zOnKiMuqsM3sqWe1lZB:zlidjk0X2OOnKifqf3sqt3ZB
False
Host Behavior
File (2603)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\FD1HVy\Desktop\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\WINDOWS\System32\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\preoobe.cmd desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\SetupComplete.cmd desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentRollback.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$WINRE_BACKUP_PARTITION.MARKER desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\SetupComplete.cmd desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\preoobe.cmd desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentRollback.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\SetupResources.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\SetupResources.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DisplayIcon.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DisplayIcon.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Print.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Print.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate1.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate1.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate2.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate2.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate3.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate3.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate4.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate5.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate4.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate5.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate6.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate6.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate7.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate7.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate8.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Save.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate8.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Save.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Setup.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Setup.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\stop.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\stop.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqMet.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqMet.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\warn.ico desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\warn.ico desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core.mzz desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\588bce7c90097ed212\1055\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core_x64.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core_x86.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended.mzz desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\588bce7c90097ed212\2070\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\588bce7c90097ed212\2052\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\eula.rtf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\LocalizedData.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\Parameterinfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\Parameterinfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\UiInfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DHtmlHeader.html desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\Parameterinfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\Parameterinfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DHtmlHeader.html desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\UiInfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\header.bmp desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\header.bmp desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\header.bmp.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\ParameterInfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUi.xsd desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SplashScreen.bmp desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUi.xsd desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\ParameterInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SplashScreen.bmp desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Strings.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Strings.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Strings.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\UiInfo.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\watermark.bmp desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\watermark.bmp desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x64.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x64.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x86.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9RAST_x64.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9RAST_x64.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9Rast_x86.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9Rast_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Setup.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupEngine.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupEngine.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\588bce7c90097ed212\SetupUi.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUi.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUtility.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUtility.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\desktop.ini.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\README.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\README.txt desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\Welcome.html desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\Welcome.html desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\AppXManifest.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Microsoft Office\FileSystemMetadata.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\FileSystemMetadata.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\sqmapi.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\sqmapi.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.VBS desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.VBS desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\SLERROR.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\SLERROR.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\malgun_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\malgun_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\meiryo_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\meiryo_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msjhn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msjhn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msjh_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msjh_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msyhn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msyhn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\BOOTNXT.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\hiberfil.sys desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Logs\Application.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\HardwareEvents.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Application.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Application.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Internet Explorer.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Internet Explorer.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Internet Explorer.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Key Management Service.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Key Management Service.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Key Management Service.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create Pipe Anonymous read pipe size = 0 True 1
Fn
Create Pipe Anonymous read pipe size = 0 True 1
Fn
Get Info C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log type = size, size_out = 40 True 1
Fn
Get Info C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log type = size, size_out = 42674 True 1
Fn
Get Info C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log type = size, size_out = 6004 True 1
Fn
Get Info C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-18\desktop.ini type = size, size_out = 129 True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-18\desktop.ini type = file_attributes True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd type = size, size_out = 577 True 1
Fn
Get Info C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini type = size, size_out = 129 True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini type = file_attributes True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1025\eula.rtf type = size, size_out = 144072 True 1
Fn
Get Info C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1025\eula.rtf type = size, size_out = 7567 True 1
Fn
Get Info C:\588bce7c90097ed212\1025\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1025\LocalizedData.xml type = size, size_out = 74214 True 1
Fn
Get Info C:\588bce7c90097ed212\1025\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$WINRE_BACKUP_PARTITION.MARKER type = size, size_out = 0 True 1
Fn
Get Info C:\588bce7c90097ed212\1025\SetupResources.dll type = size, size_out = 17240 True 1
Fn
Get Info C:\588bce7c90097ed212\1025\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1028\eula.rtf type = size, size_out = 6309 True 1
Fn
Get Info C:\588bce7c90097ed212\1028\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1028\eula.rtf type = size, size_out = 14168 True 1
Fn
Get Info C:\588bce7c90097ed212\1028\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1028\LocalizedData.xml type = size, size_out = 60816 True 1
Fn
Get Info C:\588bce7c90097ed212\1028\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1029\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1029\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1029\eula.rtf type = size, size_out = 3726 True 1
Fn
Get Info C:\588bce7c90097ed212\1029\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = size, size_out = 307 True 1
Fn
Get Info C:\$GetCurrent\SafeOS\SetupComplete.cmd type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1030\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1030\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$GetCurrent\SafeOS\preoobe.cmd type = size, size_out = 74 True 1
Fn
Get Info C:\$GetCurrent\SafeOS\preoobe.cmd type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1031\SetupResources.dll type = size, size_out = 18776 True 1
Fn
Get Info C:\588bce7c90097ed212\1031\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1032\SetupResources.dll type = size, size_out = 19288 True 1
Fn
Get Info C:\588bce7c90097ed212\1032\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1033\SetupResources.dll type = size, size_out = 17240 True 1
Fn
Get Info C:\588bce7c90097ed212\1033\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1035\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1035\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1036\SetupResources.dll type = size, size_out = 18776 True 1
Fn
Get Info C:\588bce7c90097ed212\1036\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1037\SetupResources.dll type = size, size_out = 16728 True 1
Fn
Get Info C:\588bce7c90097ed212\1037\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1038\SetupResources.dll type = size, size_out = 18776 True 1
Fn
Get Info C:\588bce7c90097ed212\1038\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1040\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1040\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\$GetCurrent\SafeOS\GetCurrentRollback.ini type = size, size_out = 156 True 1
Fn
Get Info C:\$GetCurrent\SafeOS\GetCurrentRollback.ini type = file_attributes True 1
Fn
Get Info C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1041\SetupResources.dll type = size, size_out = 15704 True 1
Fn
Get Info C:\588bce7c90097ed212\1041\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1029\LocalizedData.xml type = size, size_out = 80970 True 1
Fn
Get Info C:\588bce7c90097ed212\1029\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1042\SetupResources.dll type = size, size_out = 15192 True 1
Fn
Get Info C:\588bce7c90097ed212\1042\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1043\SetupResources.dll type = size, size_out = 19288 True 1
Fn
Get Info C:\588bce7c90097ed212\1043\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1030\eula.rtf type = size, size_out = 3314 True 1
Fn
Get Info C:\588bce7c90097ed212\1030\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1044\SetupResources.dll type = size, size_out = 17752 True 1
Fn
Get Info C:\588bce7c90097ed212\1044\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1045\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1045\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1046\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1046\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1030\LocalizedData.xml type = size, size_out = 77748 True 1
Fn
Get Info C:\588bce7c90097ed212\1030\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1031\eula.rtf type = size, size_out = 3419 True 1
Fn
Get Info C:\588bce7c90097ed212\1031\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1049\SetupResources.dll type = size, size_out = 18264 True 1
Fn
Get Info C:\588bce7c90097ed212\1049\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1053\SetupResources.dll type = size, size_out = 17752 True 1
Fn
Get Info C:\588bce7c90097ed212\1053\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1055\SetupResources.dll type = size, size_out = 17752 True 1
Fn
Get Info C:\588bce7c90097ed212\1055\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1033\eula.rtf type = size, size_out = 3188 True 1
Fn
Get Info C:\588bce7c90097ed212\1033\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1032\eula.rtf type = size, size_out = 8876 True 1
Fn
Get Info C:\588bce7c90097ed212\1032\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\2052\SetupResources.dll type = size, size_out = 14168 True 1
Fn
Get Info C:\588bce7c90097ed212\2052\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1032\LocalizedData.xml type = size, size_out = 86284 True 1
Fn
Get Info C:\588bce7c90097ed212\1032\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1031\LocalizedData.xml type = size, size_out = 82346 True 1
Fn
Get Info C:\588bce7c90097ed212\1031\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1035\eula.rtf type = size, size_out = 3702 True 1
Fn
Get Info C:\588bce7c90097ed212\1035\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\3076\SetupResources.dll type = size, size_out = 14168 True 1
Fn
Get Info C:\588bce7c90097ed212\3076\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1035\LocalizedData.xml type = size, size_out = 77022 True 1
Fn
Get Info C:\588bce7c90097ed212\1035\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1036\eula.rtf type = size, size_out = 3526 True 1
Fn
Get Info C:\588bce7c90097ed212\1036\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\3082\SetupResources.dll type = size, size_out = 18776 True 1
Fn
Get Info C:\588bce7c90097ed212\3082\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = size, size_out = 77232 True 1
Fn
Get Info C:\588bce7c90097ed212\1033\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\2070\SetupResources.dll type = size, size_out = 18776 True 1
Fn
Get Info C:\588bce7c90097ed212\2070\SetupResources.dll type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1036\LocalizedData.xml type = size, size_out = 82962 True 1
Fn
Get Info C:\588bce7c90097ed212\1036\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1037\eula.rtf type = size, size_out = 6851 True 1
Fn
Get Info C:\588bce7c90097ed212\1037\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\DisplayIcon.ico type = size, size_out = 88533 True 1
Fn
Get Info C:\588bce7c90097ed212\DisplayIcon.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1038\eula.rtf type = size, size_out = 4254 True 1
Fn
Get Info C:\588bce7c90097ed212\1038\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1037\LocalizedData.xml type = size, size_out = 72076 True 1
Fn
Get Info C:\588bce7c90097ed212\1037\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Print.ico type = size, size_out = 1150 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Print.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate1.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate1.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1038\LocalizedData.xml type = size, size_out = 86442 True 1
Fn
Get Info C:\588bce7c90097ed212\1038\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate2.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate2.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate3.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate3.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1040\eula.rtf type = size, size_out = 3643 True 1
Fn
Get Info C:\588bce7c90097ed212\1040\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1040\LocalizedData.xml type = size, size_out = 80060 True 1
Fn
Get Info C:\588bce7c90097ed212\1040\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1041\eula.rtf type = size, size_out = 10125 True 1
Fn
Get Info C:\588bce7c90097ed212\1041\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate4.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate4.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate5.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate5.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate6.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate6.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1041\LocalizedData.xml type = size, size_out = 68226 True 1
Fn
Get Info C:\588bce7c90097ed212\1041\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1042\eula.rtf type = size, size_out = 12687 True 1
Fn
Get Info C:\588bce7c90097ed212\1042\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1042\LocalizedData.xml type = size, size_out = 65238 True 1
Fn
Get Info C:\588bce7c90097ed212\1042\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate7.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate7.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1043\eula.rtf type = size, size_out = 3546 True 1
Fn
Get Info C:\588bce7c90097ed212\1043\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1043\LocalizedData.xml type = size, size_out = 79634 True 1
Fn
Get Info C:\588bce7c90097ed212\1043\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1044\eula.rtf type = size, size_out = 3046 True 1
Fn
Get Info C:\588bce7c90097ed212\1044\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1044\LocalizedData.xml type = size, size_out = 79296 True 1
Fn
Get Info C:\588bce7c90097ed212\1044\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1045\eula.rtf type = size, size_out = 4040 True 1
Fn
Get Info C:\588bce7c90097ed212\1045\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Save.ico type = size, size_out = 1150 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Save.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Save.ico type = size, size_out = 894 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate8.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Setup.ico type = size, size_out = 36710 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Setup.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1045\LocalizedData.xml type = size, size_out = 82374 True 1
Fn
Get Info C:\588bce7c90097ed212\1045\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1046\eula.rtf type = size, size_out = 3683 True 1
Fn
Get Info C:\588bce7c90097ed212\1046\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1046\LocalizedData.xml type = size, size_out = 80738 True 1
Fn
Get Info C:\588bce7c90097ed212\1046\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\stop.ico type = size, size_out = 10134 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\stop.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqMet.ico type = size, size_out = 1150 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqMet.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1049\LocalizedData.xml type = size, size_out = 81482 True 1
Fn
Get Info C:\588bce7c90097ed212\1049\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico type = size, size_out = 1150 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1049\LocalizedData.xml type = size, size_out = 54456 True 1
Fn
Get Info C:\588bce7c90097ed212\1049\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1053\eula.rtf type = size, size_out = 3865 True 1
Fn
Get Info C:\588bce7c90097ed212\1053\eula.rtf type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\warn.ico type = size, size_out = 10134 True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\warn.ico type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\588bce7c90097ed212\1053\LocalizedData.xml type = size, size_out = 77680 True 1
Fn
Get Info C:\588bce7c90097ed212\1053\LocalizedData.xml type = file_attributes True 1
Fn
Get Info C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Read C:\$Recycle.Bin\S-1-5-18\desktop.ini size = 1048560, size_out = 129 True 1
Fn
Data
Read C:\$Recycle.Bin\S-1-5-18\desktop.ini size = 1048560, size_out = 0 True 1
Fn
Read C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini size = 1048560, size_out = 129 True 1
Fn
Data
Read C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini size = 1048560, size_out = 0 True 1
Fn
Read C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 1048560, size_out = 0 True 2
Fn
Read C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 1048560, size_out = 14156 True 1
Fn
Data
Write C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 144 True 1
Fn
Data
Write C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 144 True 1
Fn
Data
Write C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate size = 4144 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate size = 4784 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate size = 260 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate size = 4464 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate size = 264 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 656 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm size = 807264 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm size = 242 True 1
Fn
Data
Write C:\Program Files\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 176 True 1
Fn
Data
Write C:\Program Files\desktop.ini.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[lockhelp@qq.com].gate size = 8592 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate size = 14160 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate size = 15280 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 160 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate size = 1424 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate size = 7808 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate size = 246 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate size = 12256 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 160 True 2
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 262 True 2
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 176 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 258 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 160 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 258 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate size = 4240 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 160 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[lockhelp@qq.com].gate size = 48 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 176 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate size = 258 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate size = 105504 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[lockhelp@qq.com].gate size = 960 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate size = 145184 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate size = 266 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate size = 288 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate size = 63936 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate size = 280 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate size = 786700 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate size = 94480 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate size = 36352 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate size = 174544 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1536 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 800880 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 387360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 496528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 253728 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1048560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 76384 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 19456 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 763376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 2160 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 2160 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 14928 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 357360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 215888 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 343344 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 65008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 399536 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1456 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 9232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 False 1
Fn
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 False 1
Fn
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 3760 False 1
Fn
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 False 1
Fn
Delete C:\588bce7c90097ed212\1049\eula.rtf - True 1
Fn
For performance reasons, the remaining 1546 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (8)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = 83, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run value_name = 1csrss.exe, data = C:\WINDOWS\System32\1csrss.exe, size = 60, type = REG_SZ True 1
Fn
Process (1627)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\cmd.exe os_pid = 0xd98, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Enumerate Processes - - True 1605
Fn
Enumerate Processes - - False 21
Fn
Module (135)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x75e90000 True 1
Fn
Load advapi32.dll base_address = 0x761b0000 True 1
Fn
Load user32.dll base_address = 0x74b70000 True 1
Fn
Load Shell32.dll base_address = 0x76480000 True 1
Fn
Load ntdll.dll base_address = 0x77bb0000 True 1
Fn
Load mpr.dll base_address = 0x74500000 True 1
Fn
Load ws2_32.dll base_address = 0x746a0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75e90000 True 16
Fn
Get Filename - process_name = c:\users\fd1hvy\desktop\1csrss.exe, file_name_orig = C:\Users\FD1HVy\Desktop\1csrss.exe, size = 32767 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x75ea51b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x75ea50d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x75efee40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x75efed70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x75ede500 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x75efef40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x75ea5090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x75efef10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x75ea3cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x75ea4cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x75ed32c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x75ed3780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x75efeb70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x75ea6c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x75ea6c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x75efea10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x75efeca0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x75ea0d20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x75efdd50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x75efed40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x75ea6b10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x75ea6760 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77bfb250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x75eff090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x75efed10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x75efebf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77bfb2d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x75efec80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x75ea6bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x75ea6bd0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77bdfb90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x75efec20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x75efeab0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x75ea56c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x75ea46b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x75ea5da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x75ea5dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x75efea20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x75eff100 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x75eff020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x75eff180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x75eff130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x75eff0e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x75efedf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x75ea51f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77bef630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77bf2dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x75ea57f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x75ea4590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x75efeae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x75ea4610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x75ea4430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x75ea4410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x75ea5cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x75ea67e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x75ea54e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x75ea67a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x75ea5010 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x75ededc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x75edf8f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x75edf750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x761ce580 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x761ce5a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x761cf530 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x761ced60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x761cefb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x761cee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x761d0540 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x761cfa20 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x761cfc00 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x761e26d0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x761d2380 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x761e2f70 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x761cfc80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x74b9f210 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x765e4730 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77c22070 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74502640 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74502790 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74502410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x746a5b40 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x746b4510 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x746a5030 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x746b0c50 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x746a5410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x746b0910 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x746d6cb0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x746b9160 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x746a49d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x746a49d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x746b8ff0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30 True 16
Fn
Service (63)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 4
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 4
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 4
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 4
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 4
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 4
Fn
System (206)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = NQDPDE True 1
Fn
Sleep duration = -1 (infinite) False 1
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 20
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 16
Fn
Get Time type = Performance Ctr, time = 13994319218 True 1
Fn
Get Time type = Ticks, time = 139906 True 3
Fn
Get Time type = Ticks, time = 149328 True 2
Fn
Get Time type = Ticks, time = 149484 True 2
Fn
Get Time type = Ticks, time = 149656 True 2
Fn
Get Time type = Ticks, time = 149812 True 2
Fn
Get Time type = Ticks, time = 150250 True 2
Fn
Get Time type = Ticks, time = 151171 True 4
Fn
Get Time type = Ticks, time = 151437 True 2
Fn
Get Time type = Ticks, time = 151859 True 2
Fn
Get Time type = Ticks, time = 152171 True 2
Fn
Get Time type = Ticks, time = 152390 True 4
Fn
Get Time type = Ticks, time = 152578 True 2
Fn
Get Time type = Ticks, time = 152765 True 2
Fn
Get Time type = Ticks, time = 153281 True 2
Fn
Get Time type = Ticks, time = 153718 True 4
Fn
Get Time type = Ticks, time = 154343 True 2
Fn
Get Time type = Ticks, time = 154453 True 2
Fn
Get Time type = Ticks, time = 154687 True 2
Fn
Get Time type = Ticks, time = 154906 True 4
Fn
Get Time type = Ticks, time = 155187 True 2
Fn
Get Time type = Ticks, time = 155765 True 2
Fn
Get Time type = Ticks, time = 156625 True 4
Fn
Get Time type = Ticks, time = 157140 True 2
Fn
Get Time type = Ticks, time = 157609 True 2
Fn
Get Time type = Ticks, time = 158015 True 2
Fn
Get Time type = Ticks, time = 158031 True 2
Fn
Get Time type = Ticks, time = 158218 True 2
Fn
Get Time type = Ticks, time = 158328 True 2
Fn
Get Time type = Ticks, time = 158437 True 2
Fn
Get Time type = Ticks, time = 158562 True 2
Fn
Get Time type = Ticks, time = 158671 True 2
Fn
Get Time type = Ticks, time = 158781 True 2
Fn
Get Time type = Ticks, time = 158890 True 2
Fn
Get Time type = Ticks, time = 159000 True 2
Fn
Get Time type = Ticks, time = 159125 True 4
Fn
Get Time type = Ticks, time = 159234 True 2
Fn
Get Time type = Ticks, time = 159359 True 2
Fn
Get Time type = Ticks, time = 159703 True 2
Fn
Get Time type = Ticks, time = 159812 True 2
Fn
Get Time type = Ticks, time = 159921 True 2
Fn
Get Time type = Ticks, time = 160046 True 2
Fn
Get Time type = Ticks, time = 160203 True 4
Fn
Get Time type = Ticks, time = 160359 True 2
Fn
Get Time type = Ticks, time = 160468 True 2
Fn
Get Time type = Ticks, time = 160578 True 2
Fn
Get Time type = Ticks, time = 160687 True 2
Fn
Get Time type = Ticks, time = 160796 True 2
Fn
Get Time type = Ticks, time = 160906 True 2
Fn
Get Time type = Ticks, time = 161671 True 4
Fn
Get Time type = Ticks, time = 164109 True 4
Fn
Get Time type = Ticks, time = 164703 True 2
Fn
Get Time type = Ticks, time = 165031 True 2
Fn
Get Time type = Ticks, time = 165718 True 4
Fn
Get Time type = Ticks, time = 166156 True 2
Fn
Get Time type = Ticks, time = 166640 True 2
Fn
Get Time type = Ticks, time = 166859 True 4
Fn
Get Time type = Ticks, time = 167031 True 2
Fn
Get Time type = Ticks, time = 167156 True 2
Fn
Get Time type = Ticks, time = 167250 True 2
Fn
Get Time type = Ticks, time = 167359 True 2
Fn
Get Time type = Ticks, time = 167468 True 2
Fn
Get Time type = Ticks, time = 169125 True 4
Fn
Get Time type = Ticks, time = 169328 True 2
Fn
Get Time type = Ticks, time = 169562 True 2
Fn
Get Time type = Ticks, time = 169750 True 2
Fn
Get Time type = Ticks, time = 169859 True 2
Fn
Get Time type = Ticks, time = 170000 True 2
Fn
Get Time type = Ticks, time = 170140 True 4
Fn
Get Time type = Ticks, time = 170281 True 2
Fn
Get Info type = Operating System True 2
Fn
Mutex (4)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\syncronize_AEDV8MA True 1
Fn
Create mutex_name = Global\syncronize_AEDV8MU True 1
Fn
Open mutex_name = Global\syncronize_AEDV8MA, desired_access = SYNCHRONIZE False 1
Fn
Open mutex_name = Global\syncronize_AEDV8MU, desired_access = SYNCHRONIZE False 1
Fn
Process #2: cmd.exe
249 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line "C:\WINDOWS\system32\cmd.exe"
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:01:40, Reason: Child Process
Unmonitor End Time: 00:02:14, Reason: Self Terminated
Monitor Duration 00:00:33
OS Process Information
»
Information Value
PID 0xd98
Parent PID 0xff4 (c:\users\fd1hvy\desktop\1csrss.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x CF0
0x E5C
0x 1064
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
cmd.exe 0x7FF65BBC0000 0x7FF65BC22FFF Process Termination - 64-bit - False False
Host Behavior
File (188)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\FD1HVy\Desktop type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 11
Fn
Get Info STD_INPUT_HANDLE type = file_type True 5
Fn
Open STD_OUTPUT_HANDLE - True 28
Fn
Open STD_INPUT_HANDLE - True 72
Fn
Read STD_INPUT_HANDLE size = 1, size_out = 1 True 60
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 2 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 52 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 36 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 4, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\mode.com os_pid = 0xdcc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\WINDOWS\system32\vssadmin.exe os_pid = 0xfa0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info C:\WINDOWS\system32\mode.com type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info C:\WINDOWS\system32\vssadmin.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Memory (2)
»
Operation Process Additional Information Success Count Logfile
Read C:\WINDOWS\system32\mode.com address = 655471824896, size = 1952 True 1
Fn
Data
Read C:\WINDOWS\system32\vssadmin.exe address = 908455280640, size = 1952 True 1
Fn
Data
Module (10)
»
Operation Module Additional Information Success Count Logfile
Load NTDLL.DLL base_address = 0x7ff931f40000 True 1
Fn
Get Handle c:\windows\system32\cmd.exe base_address = 0x7ff65bbc0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x7ff92fdd0000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x7ff92fdea990 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x7ff92fdee830 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x7ff92fdee300 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0 True 1
Fn
System (1)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 1
Fn
Environment (25)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 8
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 3
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 2
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\FD1HVy\Desktop True 1
Fn
Set Environment String name = COPYCMD True 2
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: mode.com
0 0
»
Information Value
ID #4
File Name c:\windows\system32\mode.com
Command Line mode con cp select=1251
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:01:50, Reason: Child Process
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:18
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xdcc
Parent PID 0xd98 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x F78
0x BE8
0x F4C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
mode.com 0x7FF645E80000 0x7FF645E8BFFF Process Termination - 64-bit - False False
Process #5: vssadmin.exe
0 0
»
Information Value
ID #5
File Name c:\windows\system32\vssadmin.exe
Command Line vssadmin delete shadows /all /quiet
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:02:10, Reason: Child Process
Unmonitor End Time: 00:02:15, Reason: Self Terminated
Monitor Duration 00:00:04
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xfa0
Parent PID 0xd98 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D3C
0x 1078
0x 107C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
vssadmin.exe 0x7FF6597F0000 0x7FF659816FFF Process Termination - 64-bit - False False
Process #6: 1csrss.exe
49157 0
»
Information Value
ID #6
File Name c:\windows\system32\1csrss.exe
Command Line "C:\Windows\System32\1csrss.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:17, Reason: Autostart
Unmonitor End Time: 00:05:22, Reason: Terminated by Timeout
Monitor Duration 00:01:04
OS Process Information
»
Information Value
PID 0xd88
Parent PID 0xa08 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D8C
0x DF4
0x E58
0x E84
0x E88
0x E8C
0x E90
0x E94
0x EA8
0x EB4
0x EB8
0x EBC
0x EC0
0x EC4
0x ED0
0x ED4
0x ED8
0x EDC
0x EE0
0x F00
0x F0C
0x F10
0x F18
0x F1C
0x F20
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
1csrss.exe 0x00400000 0x00418FFF Process Termination - 32-bit - False False
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\Desktop\1csrss.exe 92.50 KB MD5: 014ce7dd8860b2dcbab3a8d5ada84cf9
SHA1: cdd35424ab9c45a46b3467867500162e84530471
SHA256: 36b3ef72679ab1bdf384892aa721db4fb42971618510081d206d61a90ac3582d
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4A2Q1+ozUHXCuv8tRCqoaPNJPZE:Qw+asqN5aW/hLiHHSbtJrNM
False
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 9ed3e4c590124cd68938a29932aaca82
SHA1: 6af7597d0dca56b74b5c67432a328cee31b8fdc5
SHA256: ec7018831f97ffdae587239c2ee1c21861530742e87b1f0e247f0e41e33c9944
SSDeep: 1536:MkinW29Fxai0WTfh/nWT85draFaCwFDkbm1Yrdtd:R4WtX4h/z5Fi0Wy2H
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 866f99ec153ee22af243e565f691fefb
SHA1: acfaaef128d825e7ec711965381e8b1bdae8625f
SHA256: 6de91fbe36358718b798366097bef7e56160961d1789da2a9e76b27650f82957
SSDeep: 24:if3hnCXt93n2S3e07Gz+Mta+9CJdn/GQdgOX4GvZrxocKpfczYf:63hO93v7ohtFMJd9dgOVda5c4
False
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.35 KB MD5: 455c0d2c416ffff9992d2fddaec70ed7
SHA1: 84907457f1ea4de73e49ed5f164c67f56e717bcb
SHA256: 38aaff60b3b9a8c489210a9cfab53947ccd976922770b83706c3a07b88d6e617
SSDeep: 1536:8W9rN9klvx4/zBwdTNYqGotlbfB1jaM7maGQPiaJsiekZpZCc9FYs:8Wp8N0YBDD2M7xFTeUCYqs
False
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.37 KB MD5: 01a7036d537e4e861806fef78ef78f78
SHA1: 5f877ae45cd72870e403cff39a39582ffc38a1f3
SHA256: dd6813a52d3fa3beebe3f6124b7a37b3278f71c70653163668350dd0f4c12216
SSDeep: 1536:PePiTyDatAgKpUpAZ+rM5xqMQXEgNMo3wtTzBh4UHTzhqmSXu:WPiTtrKypAZ+rM5xqh0U0TthPHTzhnSe
False
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: 56acea80e9ba3eefb00d4297429a0593
SHA1: 8b028e426789ba062871e9a5a9355b96ada5f68f
SHA256: ec0a0bb418d50d7c6f0859278dfed5d79f9636fa22868529499448ba88372470
SSDeep: 1536:BbJrsFsZoIUZMTTnfhc5kyz3H0lgMzqoShfPYUeyHUTc+Ke7zsKcX:JxTUaBcfolj2fSyHp+/QNX
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00154_.gif.id-b4197730.[lockhelp@qq.com].gate 5.43 KB MD5: 513fabf78bcf9395055035bb02f9ebf7
SHA1: 7406dd59150b397be013d1e99a3393c6d2dd97c1
SHA256: 623c492b654426ddf70ef757fa54a17bbcf89547a102d24ff93ed780f38083a2
SSDeep: 96:adMnbTQ+fNpWR00I8ofzXgYWM3nBuh89vgi3yXUf4U28cLpeq+PAW0Z:adMnbnNpWR00I8czYM285yXUwU2DpeqD
False
C:\Logs\System.evtx.id-B4197730.[lockhelp@qq.com].gate 1.07 MB MD5: 43a1de01cee637bedbbced5eb444c010
SHA1: 4856c8ac48af9190253eb0e46922241b45fd36cb
SHA256: 7e5b454df16565a89de30808825682c4ad1ff589765af1da31489f0ceb7065ad
SSDeep: 24576:VHpALD96n+mYxcd8fSLRyB9xz6xw+Dgtb2aZwCBVI96qsjbQ1rNe:ViNOXwB90xnDwyi9bI7brU
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01084_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.03 KB MD5: 10f1ab56aafa89f86daaf61bda16991b
SHA1: 240feff6a024e9f8dd2fe17324ce9358a1d7b218
SHA256: 0655d4f7f62bd47b4b1548769bf1ee7cb79b65cc4d9b69a06207773d04b73b22
SSDeep: 24:UDBiKLUfe45xtoaf1Jc7bFJuvpuMmDqlIwibaoEP5ppWFFQIiOkE3pcEpkZJ2f35:U0IEkfuv0nEIwSA5pa3GOkZo3VIyJcK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00296_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.03 KB MD5: 23e40896722ae94f5dcf65e18356d32b
SHA1: ce9742b22ee00911e0bddfc5c4f10a80a7f422f6
SHA256: 07c7a4c862f33b691e9f62361da35e0097c7ab7686eae65c4164ea7809a706f6
SSDeep: 24:3uPDfQFmxDeoSEyqjEpSpV/d37C2YgY+6Skpv1ThHFNnvUfczY5:307TxDGE33pppjY+6SkN1Ttv4cK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00525_.wmf.id-b4197730.[lockhelp@qq.com].gate 9.61 KB MD5: 0794966ef80c019a8dcf916286f421f6
SHA1: b3faea61b75e74d9b81e00f7d70304bcc4d86c7d
SHA256: 22948e80cb83a4f6a8150b20aeb5c5a9366261e378fdec71d5e0c39a4130cbf1
SSDeep: 192:xpHhwFbbobo/gDDbaGvs+YY2yrblz4Hfw9bgcJeD2i6:xpyFbLCDHSYrrt4Hfybgcs36
False
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.35 KB MD5: f173124f7ee1cba6fef733b7ad6c1095
SHA1: db53c976cd879b6893839fce7d2bf85be74c5993
SHA256: fd84d711d19e9b3d0c177513c606b5cc236d52a5e003bc841e2b32853ea59fcb
SSDeep: 1536:TLtjoxNYPWvIx5VIH6ulj7MYz7GSH3LQhXJr:dsxSWQx5Ruh7MYz7GcQhXN
False
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 640de76d8439aa54781323976f9fe6da
SHA1: 033e93509602aa65107374d00265fbe5207dc452
SHA256: 9e870ebb1b39b6bfaa8db1ecc2ec1f38d914ff277cd4c9aa2dba2d07283b4cae
SSDeep: 1536:zVDzockyn7jCOAe6YTx1zqTDq5JxXhzxg9OhiH9MJpLP:zVD75KOAe9N5qfKg9or
False
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: cbeb8ffebe2dc1aca49679e1ec44cc1e
SHA1: 812c1e58b653898accd1b39d73e683b40269269c
SHA256: 35da642d089642def14febc1920227cdc7bf49ece49c3306521fb12e899a1542
SSDeep: 1536:Ihmlc86h8N3+nBiBKuvCmANFONHortP8zndubip+FoBZAu:IUF6O4CCmAN2H6t8zYj0eu
False
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 361de4da6b8441b22a858ddabf4bb461
SHA1: 6c978169e7da308367ab81c454bb9a647a631b75
SHA256: f1e15611feabdf3aee1d7a22f770880813dc300c22e40869502ec8081167853d
SSDeep: 1536:eKlzAjZhnjVhAZ/3ham7z/D3AjehAOkzkV6HY0fA+xO:VUhD9ILhhAOkz3/+
False
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 628d0e590f729b3bdf4999b80686ba46
SHA1: fb0f6c344d0e3564d139fedb8dc9f782363a58ca
SHA256: 8392e60ebe053222a52e3be82fa3f39ac31c8316822b193954ba64152b67d72b
SSDeep: 1536:iOaOTl2znJedXZm0ayzu671Pz2M1zVbxsd8P:iOaOGJqwDyzu6pTJVbxp
False
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: d6170f9aee3af00f72936f1f23a31b12
SHA1: 1b9634d97a6c35b50deef2b7146e491ac78c8284
SHA256: 1750393c0e625615d7fdb002f2d695370d19ad3cebce608f2515701012bcb25c
SSDeep: 1536:c00CGObtgxaeNb6z4zU1+CLaKtn2t/KGU:chLStea4HK8I
False
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: 2ec299b559b075ce093b7cb88c5aa3b2
SHA1: 10fbbd168647fbd98ebe3b8999cab3de9a695759
SHA256: 5c3808c09ca9e7f99dd7913bf32963f9c7b920a6540fe6f1581fa463187f9742
SSDeep: 1536:5kHCMkaSQ6Gt3l8JPe9pRzTM7bB+/v5EvTu:5qMPQ3t3tRzgfB+/xwTu
False
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: cb51f07d7220bd184436226e5749629c
SHA1: 8c77244a4472d8f12bad15c608c764e620379440
SHA256: 877c080089d2d60e65795dab64833c91d509c833c9437e09e84e558c6ddeeb8b
SSDeep: 24576:05B1vieQotNBeimppYP+euWAyqFO57LB4vQ7jWD0u:0EehtDeXmnFqFkkI3u
False
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.34 KB MD5: eae71454642be5ac2b3bc3e79e8c8e53
SHA1: 1057f5be7424219ad72219efe262517f1e6ad45d
SHA256: 9783dcfe3dbf5363f4386dc2ac7c3207e9cbf0b38184366237f457929beea23e
SSDeep: 1536:yuzgoH1T4RFKVwqoatmguDLepHuwYsOrZXlWW/vrOw:2oH1T43lra/uDLepOqFW/vb
False
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 73663ee32e8459ca4783ebfb713b3a6f
SHA1: 6ab98d779c9682bc7174eddda5882ea36fde63e9
SHA256: 5b6b73ba769c67462b06d1b41d0ebac6eed8cfbc62606816c5ddf6c2699b9b16
SSDeep: 1536:CT9//103RwrfzOp2kh6yyJmElrLOdIqG9sVU8Fsw9EEDSEkC+BvScmCzm:CT1t0Bwn02klQNlrLOdITsU8Fs0XDrC0
False
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 1413d439734632f5502df0cf4970ad4d
SHA1: 3a3348326687c9f9c7bcdc9ffd0caeb77904eeb7
SHA256: 3e21bff8918c8dd907461a3eaae18db29a3fbc1f01e6c78650626118274a1c72
SSDeep: 1536:9yDmsj2t1JzC9nvxW+VWikRlZa15pE15c4QQE5aNxM/Q+qRKx4hy:gDmR1JO5g/bRlc5pE15cKnMIhK24
False
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: d7367a23e32e362309de2e13af50ccac
SHA1: 5c1f74b135b3ec0d386146c7f00e5ecd61dacc18
SHA256: 9f525e28e0394a2b43cb52ab65da2885783f96f63998e71bbed227f438053165
SSDeep: 1536:cGLigNkwAe9es+shy5sda+H6VUQdPnpRoS+arMZwVUUE:PWyQeztcf+gUQdPnp+S+BWVDE
False
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 5170808694e925c5e4a3c551d03c2c44
SHA1: f4ec3320e40506565087b65781aab89d7b7a1c46
SHA256: daffb34cb83008d12100b32691aa0e4120af94a1f93377e87d0434c45e8aa9d4
SSDeep: 1536:2+SJFapyz3hLYFCyRgYMPFNQpL4DZbWEc3WuIx6pTAYiWBFFtE:2+S+MFY4yOPFNQpL41Dc3W76pTAYiWFM
False
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: a696c17f5e28bc5d0f1afc1d339fa746
SHA1: 9d9a5d2fa1b7dd09b2bab4c5380ee5022125f5a2
SHA256: 55919eaa5e221e4ff1c2b7fe76e066e5db161d6db87aede17a73a0cf7f1659fd
SSDeep: 1536:VqcODT+G+LZS4MQxX7OyqsvZMAun2e0lSAQka4tgOVPph3XIz:lGEZSHQl7Oovi2eICk5tgOVPXIz
False
C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 1328c664f137be5ecbd6e074e039f170
SHA1: a642c91b679f5635a4a131c38ca0144eb6841c77
SHA256: ac824bda899dddf505e181aa132a766159ce155c5f0cf03fb241307292b74796
SSDeep: 1536:MnKVpb0NRyR0Ikuaij6blS+Y4r/6mh+UbyHI8nBeG5:6NRqCxlS+Br/V+UbcI8n4E
False
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: e2a0aee5e031cd3006730e16238c8bf1
SHA1: d4641faa22d0854584e77db60faf72828ef78cac
SHA256: 49258370cc85274b064b239cc9b943328394c96d679fce4274887686f2456f93
SSDeep: 768:xCl7Y6jsd8MmGWF0uYyn7y86MKVvQKsQhs4lVMZjWjiNAoyCdxpLYvCY5nsRPUAq:qrCfm7L71sV6Qe0jiNAgM6Y9GPmzhE4
False
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: 45862e354a531fc904ae869e3f4be9d3
SHA1: 12e7ded980e12673a1356322e5ab3e1eb0d507c6
SHA256: 219e377ab2e3a6b5a489c6cab2de3a947ee873334d1873d89738d0aac1b2aee1
SSDeep: 1536:paRSz5rn+slpe/t4zpyoV6ZfdMIGlwKWm/3O7Jzy9F:prz5x8hlmwKVOduF
False
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: c72d51cd01d320703f839f01066d66bc
SHA1: 4b3a74e14a14f73f96e4c6e318a4ac908dd54297
SHA256: 409fda3619565b68d63d47cbe10c82cd5f0ee50c4337858c072fde508a11c31e
SSDeep: 1536:Ee1J8RI8GWQrfwN0eHwTzuFagxfrE0WpVJxenF8XD+8jXfeE:EeOI8wrfwNf97lqp3cGXtjXfZ
False
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: 275e2d46898f2dda5e28f062585a0654
SHA1: da962f81b20dbe51f4927cf7f4cc58726a844a45
SHA256: 5243beed679e81174ec4d5b09454994c8dc58638799539f140b01b8fa66191e1
SSDeep: 24576:jxVgC6ox/sgX2gL9GkQIR0pVU9PV3Qx4TFr1IPbjn8S:Z6O/3hLQVpVU1VgmTt1IDYS
False
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 263ceb574ab51c62a7658ffbe2a1ee14
SHA1: dd285a36f6b428de21089373dc9e5ba80d0b3f34
SHA256: 09bd861677eb7fdd431e8502cc9dcb573f97267cc33ed52e504b917e8438d1e3
SSDeep: 1536:SAVAdmmS9R4T+JY1WUuS6ySIN4lkv/Sr7pMmbrzSgRmb0VUEhA9YGSaNjqU:SAW+K1WTZ44lKcjCgbUE+l
False
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: b3cb636b81e503064a80c9fc9aee0358
SHA1: 150fdd824a67dd24ef7fc07f4866881e18f29279
SHA256: 212bfc1550cfd50740aee6b40477fbd8a4136827840078e9e7492675732c950a
SSDeep: 1536:wV9c/piDQzU2hnFjkfK0hhfPp1LvSUO8WcnZKLvXyyo/PfEOTV1mWzWw4bfuWa83:wV9CiDQZhnFjkV5xmFzxo/0OTrHz/4bZ
False
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 59163f6875d0f0948f2dcad69ecc28f8
SHA1: 381c93f0f05c65e2ea8381144d84760aa4c35c50
SHA256: 0dc448810ba15ee016c934a8953dcecfdc38bcd3585cb7c895150a261a75c59a
SSDeep: 1536:P55BJU9Z+IxrW80vjPAfik5tp3yXD+5i/l1SlaUm1lTiT:x5zkZdNW8cEYuiClVT
False
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: d59d27c29c8d88fc805a03b5a2fbba47
SHA1: a46bc1d10d49492bce033c619b737e0b12dd1037
SHA256: 0d863aaecc2987b4393d86ae421efbe366c8ebd5568368b9af1ab4d2f04730f5
SSDeep: 1536:pN9V61Aj4515N3j2MCUIxdhApOxZabh1DxteKFdgr9KQrVPqlmjGmtns/:HL61Aj4H5yxdiErwhnZdLlmjBne
False
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: dc7f01e05603e63adee0e18147fe7088
SHA1: 1d3f3c90f1db1b909991829eb0b8b737702b4fc4
SHA256: dfda2f0c59f5a8c86d4b3eca0b608abd1775ba096775879b18a5733c4ed55530
SSDeep: 1536:AXBV4baLqI6D5vUzwjthcxgdBD1jGR0Dh8gNsvsCzFE9Do:AIbQxaVUEjthcGOZgNdC2Do
False
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 532e0f8d6c6e8ce33a5f02e905ba6326
SHA1: 1ffb85dba026aea2217737c86b11dc3d10993881
SHA256: db1f7ecd3b238cfc08c2a1a28ca62e8e6d7d616ba463bb063a497c60cf29e184
SSDeep: 1536:duggYA0wkF6yqdxe3uSYL5SmalJO0CY/CPExw:duggp06yqdxW0L5SmsJEYK8m
False
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: d75e0644843540884545777b01a9ebac
SHA1: 15ace5b1bd8167c21703eb5c2429e1bb142357aa
SHA256: 8de77c866cbd3d6e4edc5792043a3e1e7535ef50059e08cf63509c9b03404368
SSDeep: 1536:FaSFdhcbKp1sXqYa6KVP80l7C7O62+e88dkErjJiEKsN97cFkrKH5ZakkWv:FaOQKP6KVPdxC7Ox8HEvJi1sNJ5rKH5V
False
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 8867b6df4545b7e2c06c00af08ae829b
SHA1: 4770bf405bd19ed7fa23c4148882bb359363690b
SHA256: f58e7a844e96183e2e97cf5a08a6d2265eda8b17cc44f34cbbf7cca979a35080
SSDeep: 1536:eu9Xy+9oxGYP8bQiBDXFA6/RaLkkwj6ulNA2f1T8lWhK:eu9ligxDXW6/QLRmT1ulwK
False
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate 68.29 KB MD5: 655257cf498aa51a390b844b5804861e
SHA1: 0fd911d1570cf4bf5502c95ddf68699d52eb8091
SHA256: 395cfba8e922f7fa4f16ef9afe2a873255912980c11301a566a0b76dd36bb94d
SSDeep: 1536:lvlansKDmdA6oh4FFCjxGkMpkfDmzaetdsyLRcPj61UABD/ZH7nrs:lvlanyvFFCjnBa2MBNcPwUaD5s
False
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: dc1381e8a4274de2e5e5b7dfb28deba8
SHA1: ee3e537fb0c26e5070ff823d21c31cc11f344e24
SHA256: ff5455c26a6ac46c9bbfc76c6d96ca0e03bf90f6eeb56801a10493760b73501f
SSDeep: 1536:3z35D0BdNptjRllnPFe1XBqTpeFq5D3gZuqFpINV3SVNYsXR0:3z3BmNjRnnNeiTpeFqVtZbSVNYEm
False
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[lockhelp@qq.com].gate 68.37 KB MD5: 279b6e9fa4073cfd56ce91ff7cd6acd2
SHA1: 8d2904893bbdaafb37c82ab02a1a686966b23bd6
SHA256: 4ec55ee9cdae95359185297c6ce8a850d60fb1c045735403d168a34c9667e9c8
SSDeep: 1536:VqwVxpKX1qh5S6gPN5+LsSE2/zJ2c79VZNl02592w4S:VfVxp45PNgn3179Vu25IS
False
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.29 KB MD5: 59c97e65a889e50818cee9dfaa15c2fe
SHA1: ea37282dd6ed62e202e36ea10d19cb81b7b87640
SHA256: 38229e21c6ea4debcdd6d57e720910357b23c0e1d1c056983bebbf726ab3e2e6
SSDeep: 1536:ytSuSwg4LC+WWQ7Mtb5tmJBgErGhdl2Zl6fYq3dtYncATFEAIxgQJV:luS6KDMt1tmHbGhdel6QqHKHFaxT
False
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: c4b0854a9242c00143551f9568c62745
SHA1: fcd888c535aeb434c3b83341c2062da22b433f08
SHA256: 7344bc863993e13eb97c66022994db0670b39a73c55673de2da87ee91f9e223a
SSDeep: 1536:iUJqI0RY85oG2zpXSLY26sp0OPEQqI0bH3+Yw5fDfDBuHRK:18Y85T2NXSLx6sp0OJqIEKRiRK
False
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: e491eaab664367bf50da8e067b196390
SHA1: 1e4cf33ae8d23670669c5ba96112c486de5d478d
SHA256: 2eae2789e678c555130db4e8e357f9482af7e6f8ffd737e5fd04cb05049db2b1
SSDeep: 1536:3nFwhxPopDLL8qjYMBX16Am4RfcVApvD3WIEhpBCbBBC6sD9CPr6Fb:3nGPmDTBX16ADfCApb3spIBBCp9crQb
False
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 46baf4f7900a18fa2101b7b1e3ee62b3
SHA1: 7b91096366316e0527996f1ccdab1564785506b6
SHA256: 9811ddec9d44825c347b4c497dfe8f1952f0f31c97afc8764beb9f38b6cbf58b
SSDeep: 1536://LGh/VZgsR+wwpbI/qjocLUN/SSAdudMzE5XIC3ArT9YoeOBWgt3://IgsRCS/8K/SS8GCuYC3ArTSolBZt3
False
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: ad605b8a024533a2073abe069bf684af
SHA1: 1a3a2da30b1e462b0e7e705bbb9132c6adb76909
SHA256: 2f4a7a72d0d8d8725c31041ea8a333569368c19cb305bbb8444469f2204b72bb
SSDeep: 1536:OV5VvWyDMYS24kyo1spoBIe3vVweIEfl0zsDUyrkLDYvyjxNHVq+0D:ULjQCjyo1YPe3Z+swyrnazHH0D
False
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: a5a74372613792c932f27287d6dde2ed
SHA1: 926689aadb325295e9f3395b94fa6591c002e91a
SHA256: ad70477b0898412e8c5427d13a3194f6f3d8e7850ea3c9949bc85d947197cabf
SSDeep: 1536:o+MMxsGvo+8ZpDcJAEhPs0KU46isKLlmGJF3SWKV:o+7xsTblETPs0K9muF3pKV
False
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 746e2d147684595b502a8ee6eadf3b5b
SHA1: 606a8c1ac92b06f8804b2ba44991e5597abeba46
SHA256: b0e299dce74854087227029ee4188a4bc17d059c9652cec9b19c5ae097372325
SSDeep: 1536:I/62MzxJd7X81agKj7t+H1xofFihblnGlqiu4J/wX9wA/ZXCht:J/zx/RgCB+Vx/Ftvl41wX9w85Cv
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate 515.90 KB MD5: abb2fa0dafff211a4d9b62fa8a6d7950
SHA1: 80270c3ec25d51311e71a1688e0fd7147ef8a6f7
SHA256: 1eeb46649723faa35977806c977455f4461364e8db87217cb1b1083fffe19bab
SSDeep: 12288:Xg96kUDEas/rPVwCvvZQtkeaVXccAsf1u5iPAH3EoSIg:W4DZnCJQtkegccAsNupg
False
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: 6ab90d024db006f6257cf2857309a981
SHA1: 792d8cd94dffafafd95eac8c509f870b7f4da290
SHA256: 73daa7fe64db07e382eeed73477660b8b2af9630c97c7da1d9f2262fb430fdc3
SSDeep: 24576:btkes+Skest/R4lJZUkeqNrfz9bpbzEM5oP/3wI8kif3:bue1es9R4lbU9qRzbb4Ms/wku3
False
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 7ab349b236c067f4258030db6771bc76
SHA1: 53dec7313a32bbf65f3d0900db4c82001eb1e10d
SHA256: cdfd81091bc613f192eb4e29288898fa302e38767095c49415b9255dfc83eb5a
SSDeep: 1536:IH/UwuCIjBsQ2g3HVmTI/ct2jK9cCigJyRNQxBw+mrLWn+q:/wLIFsQf3YkZKiWJy+2gnf
False
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: dc43617d2ef3478df7b940f9e8880aef
SHA1: 8faf28e3a63818ea7da51c7b964e7d2cb2bd838c
SHA256: 8c8463497a6cb99861b855a1aa55298b7718098e3f2a97e6da30356b556216cc
SSDeep: 1536:liDHJXVeTwgMfAW9x1IxfYOvBmEM76yFG3rvVCu7Y4is:0j3I4A/YUBmEM7r0rV1Y4N
False
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 9cb2c60ab006dc2ef5d70456b70035ce
SHA1: 42b5e4b94eb3e25ecace9fb48f152519e8c1d64b
SHA256: d05306958850069b4ae62a380365708980d989d70e281b545e028f816d692645
SSDeep: 1536:HDpnPa9xWsCB09yPEq7/q7AjTHQbnFCxGMsCEek+b8TR0YDapRI1R37C//eGU0Dd:dnMxbCBmmE77AjTQbnAxDsJr+bs0kaph
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate 1.54 KB MD5: fa59ae5adfce4d1e71364629466a314f
SHA1: 0d83efff3f92084f5616bf01a80bc127e4717d13
SHA256: 15e3564ef6acca47b48f76411b7c6cbef2e0c438ddfd4a159fa2441b9a5c92f8
SSDeep: 24:/lMKBG4iTIs1zPrCjtCobxumCUkFN/ym+gIIoCK+8L6aFIHQbHTU1Zqvn04rlRMG:YICTMtLumCUFMC+da6HWHoOvjrr8ec4
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\appxmanifestloc.en-us.xml.id-b4197730.[lockhelp@qq.com].gate 9.87 KB MD5: dfaef063cdc3182adca6c4c9fe61300d
SHA1: 7539e9a27ea605d719aff866fdf082adcba2b7eb
SHA256: 4b5933da52cf5873715e9488f7a92008965e1579ebcaf53a02dd94794a882acd
SSDeep: 192:r5YcK4UgT4eMAMk3X+nYeyUyOhDyNDxAuirWpxjxmneRVv:r5m4lxPMGrQyld2WpxEeRVv
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\authoredextensions.xml.id-b4197730.[lockhelp@qq.com].gate 0.62 KB MD5: 0a8c2e891ee379fdd7a75245caa4bac7
SHA1: 459bcb76100426360d7960c3beb73dc738f76dc1
SHA256: 7e07cf881b300ac7ced8a02c02418362d536c94087831a9950653691e37fe294
SSDeep: 12:xfGwX52EuetGUaCahM3TzxjLq6MNz9feHzvwXl:xfNXgIOrQTVqBfczY1
False
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: f13db117bfc54b553211810a356b826e
SHA1: b691a5577d8a1f4091824d361907c6238079ebf4
SHA256: d05ab91e7eca45fc26915ae7e20941322e49f8fe2b08c875f67b561fa2e5859f
SSDeep: 1536:KQeUs9LUDORqeS/nF8gU4VAH4LPNRvlAIQw594ST89LyoPcZb:KHxBeDnFXrAifmK89LyRb
False
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 30e21087f358c2ced5611070d3aaab05
SHA1: df8175c4591f69e405e9b728dd83be48d24c9ad0
SHA256: 0833ad33bac39e206e51841d31554bc4e4a6bcc4259b3123d7288c6261ea0549
SSDeep: 1536:kMNaJZqjWz31XLIHsDl2iyjsbDeg5RyciCmOIiw+Y:kl2Wz3tf/y4XeQRiCmRie
False
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 16c6cbee904b54fc6f3e23c5803ac98e
SHA1: 986cab9a4794845ebb1368fd2c0bc4eef1ae34f5
SHA256: ca0c228aefd16238f3d38749f6141bac4ae666fdf11512e2ab75cdac8b92c4c3
SSDeep: 1536:TCpEI9DVb7WhFcJC32gIO/n8+9KQKNV/wVAqCP/UsO9BXxB:ylDVbqoJEIOU+KQyIBCHUs6B7
False
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 51c92deadd2dd9f3bbd60c0dbe5f17ed
SHA1: 1c11505760b9e71f00eb2ebc0ba1905b3b47ccec
SHA256: 3c7b1faef24c7157cb1a1e467ccd5966c880cae72c6c31711f95c2d6d587552b
SSDeep: 1536:/4M28A60/WK0v4cEoQTHNo9102zWFJrYVud/riTPXOBI8/xO:AMQJIL3C4fzWcud/WTfGI8M
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\packagemanifests\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate 3.61 KB MD5: 6752ba488d266682754253fc9d964240
SHA1: 6cd8c7d83e98a483fab9cac9139874d9e543d0b7
SHA256: d7efae59691b1aeb8fdf35f1ff76aa08b72caa1048c6349b1d45786144e118a0
SSDeep: 96:ml48fvG6vrcz0EVC4G99okZFXjpUAS0slGQqlNCmMsT:meAe6v11TBZFXjpUA4lGllNCAT
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00004_.gif.id-b4197730.[lockhelp@qq.com].gate 9.06 KB MD5: 45f06241e7bc7eed371c868453ac2c45
SHA1: 2f2bac83945958d7736c308821c1474998060d71
SHA256: 35a894f50b90ef1cc06a786f579d1c613e916eba2a86694a53098f411d26d51a
SSDeep: 192:Cv/CQYHk1RgblFjriGdphrCEaZsNrJSwp+IJKpwl/9lrDJ:Qw0R4HBlayNrHzxrDJ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00011_.gif.id-b4197730.[lockhelp@qq.com].gate 7.29 KB MD5: 1742f6e9e5ef541b065f4b1dd898fd95
SHA1: 66de100e65301f04218167030cd503309c15db35
SHA256: de09deec18cb91c46c78d892382baedfaac57e9970b8600c01bced0d0890a4ee
SSDeep: 192:wJui9Wh+8DSc0+hd2HBWL5qEy+de7EuTL/3V:wJuiU+8DSc0+hd2HB0sEy+dnU3V
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00037_.gif.id-b4197730.[lockhelp@qq.com].gate 6.76 KB MD5: 534fb2595234149d903909a7802b4f79
SHA1: b6433ade9391aee3004ac3aa9dce93a6f34e9eb2
SHA256: adff4d8226f05a08440ac704af3a8d12a510e34e3d3fbdd26cb8776351e6d8d5
SSDeep: 192:x/HVYnVw6C+tPwS8Xk5HRyT/R1MVZ6/rx7p:x/HVWhb8A4+mrpp
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00038_.gif.id-b4197730.[lockhelp@qq.com].gate 3.42 KB MD5: ee3be77bac7741fb5cec9ef0ca191d43
SHA1: 1ab139a34eb595fcfab568da1fb84d9905fce5f8
SHA256: b23d751bc9709edebb85991b6780307a778bf602d5b4891a199a91f7c79a2f5f
SSDeep: 96:cWxdFS5+ZSIRN4CaemY0+3rDOgOivv8c9gS4JR5R2b2/+c/xV:DG+rz53WgX8XT332N4xV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00040_.gif.id-b4197730.[lockhelp@qq.com].gate 8.15 KB MD5: 34b1c7f29d201a3b4a2d181e44384c9a
SHA1: 1608c7698d8e359d6b24269c51e2e318eb5cd137
SHA256: 798c8e25e0158a5e92e037dba65c9f29a8ac89a1f7b6d0ba68d26d51e8c77daf
SSDeep: 192:2ve/yCVxRiuDsHwDog4EnRmpI8lAY8rHfYFGyv:WCVxR+elnRMlAY8r0Go
False
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.35 KB MD5: 48c908180f6585d99de25c960634e39a
SHA1: 74b1563d1f242ee3bceaf11c9a8edac79d8969d9
SHA256: 8fe19f25e204546f4d78fc3bbf7667083180d88217fd78ed675d41bbb404ff63
SSDeep: 1536:xy3gY8QuXBYZCPl4PDTjAyAKlcdvdz9r57k0D/2Ib47:8gDQuZPl4/kxuc9dpH47
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00057_.gif.id-b4197730.[lockhelp@qq.com].gate 11.86 KB MD5: 0bf9ba449f7283b05d49ccffc5112e9a
SHA1: e89789455bba3de369ae5fc654d03f2a52282913
SHA256: f370ffeeceb61172c659fa2803d4874230275dfc21b0e77bef21aabda41254e9
SSDeep: 192:knlTj9svUvYn+tNVkQN+SSwm+Pl42PV6K9f6+frPhV+1SXp00B5Bvte/3r5zriav:kl9svUs8kF1w7y2PLoyPhV+1cp00DTyP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00021_.gif.id-b4197730.[lockhelp@qq.com].gate 14.76 KB MD5: fa1a58b7849c317ca64ad6dfcbba0eb6
SHA1: d5a56c2fc15c3e8eaede43c8ba1c5582a046305f
SHA256: ede59d654468db2e6734e56d97decc4e3822e2a8c55809c620457d55fea0fc4f
SSDeep: 384:xewb88jL7AkWtd2NdfApPG4vfdgJuc0LFbk3:BbeQdfApPGJJua3
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00092_.gif.id-b4197730.[lockhelp@qq.com].gate 0.73 KB MD5: 2a42f6a0579fbcee7fc7ad571b3d1f7d
SHA1: 2bba6b2a951c604a60e8cbca5c62becf3036e115
SHA256: dbb5bc676bbcefbe275bd1cb74dfb79de1bd29c258a9d8fc2a041e84cb43da25
SSDeep: 12:zb9xOr1Twf04pCKI1R1l0lXlxizeWmHkWK8tzgtvH+hoV8feHzvwDl:zb3OrRY09T1R1mnxizegWhtz4Hr8fcz+
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00090_.gif.id-b4197730.[lockhelp@qq.com].gate 0.75 KB MD5: 5d7572274f048affaa2ac67d14d0eda8
SHA1: e7554c3cf60b3ad322a70d5014b86736571f4207
SHA256: ed6ab03cddb42bece1a7cfedf6e7a3ad586304de64caf59af8df8bfd942ece2d
SSDeep: 12:i3Qay+pwO1Kj8NwRCemMJ+FTRgI3TLWAOCSIyPxyFWmquJuzWTMJxT4R+Xho/kfB:mE+CO1K8w7qbwCSl5yFLqCu2Gpikfcz+
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00052_.gif.id-b4197730.[lockhelp@qq.com].gate 7.75 KB MD5: 3a50ec845244c8065d7a492daa16ffb1
SHA1: f93aa76554fd6c2c5c178b3566eb3f3487669f7b
SHA256: 897abca8ee1706c231752435b0056551d000c63646d7167f7f3d6f209f330a48
SSDeep: 192:rkkBkB6VGS8OvdGk7RWU/vVtwOgzXdcy+hArgXVHnA:AkBkB6VsOVG0Tt7gztkhAMX9nA
False
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate 68.36 KB MD5: 50f75bf3ac8387a96b79948dbe9a7a15
SHA1: 0539df932076806bdccc9a0a3656cdd25c279fe1
SHA256: 21dfc94b95ab3047df39b2167a43d43bda2711f9f1499bbf7cdd0b7ba361f852
SSDeep: 1536:JtWPGiPl35YLMW5yGN1Zk0Fiyh3gCEUL62BuTQsNRi+39hKDxQY1tHPc:oGiPlpYQWoGNVWUL1E+DdQY1tc
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00103_.gif.id-b4197730.[lockhelp@qq.com].gate 12.64 KB MD5: f3c735aa65a62b71d2a36534ab12992e
SHA1: 0d864d8c922ee7947f2ec42e9e2e424448f1fca9
SHA256: 9b95692d65579ca37a92bac30ef126a7a93c1c13fb8a536f5e3d61582eb9ece8
SSDeep: 384:bAqAFSNJlqe9xcbNvTW9v6JDEKoeMebTcTwhSS5HTzmO:0FyJlvLcxva9v6JDEleMBT2SSh1
False
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: 35f4c5e2554675553403649d17581986
SHA1: d24cfd2a982a37fb34eacddecc183b0486c644f3
SHA256: 6e1f225729ea19dd353a8178875d0359a4654cf36520520dab66dd88ba17f1a4
SSDeep: 1536:IVeWKadx7/BBCcg8H87NPXqw9No1QY3kpnwAlTgjxvP1:IhTfpUcgWMNPac8QTpnrKvt
False
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: ba42ba5ebacd7f3e63d39275f3087701
SHA1: 056976d7d0900571093e31a0ad8f2aec36c1d79a
SHA256: e0a96fc7912ff4a84717e60e64a8d042d175d2c6b9a2ffd77cc8257ac63fd8dd
SSDeep: 1536:K8Vbi2jb0/ldGHoBKQ+kQF6aho0RB97TiQjXIEA2UQLR51K:sfGHoH+rrhxFjYo7L1K
False
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 1845ddfa4fc46e507f43ad376fc3dda8
SHA1: c102ca4a017190f38be064d4e163b073f7cbe00c
SHA256: e7351c213a98ca4e5e127a195ff9e900be978a254f79b048959b60dfac63b4e5
SSDeep: 1536:Bc2eVAAG0VNOvdiGiJKlfYpphSAWFCy82Nrim0Ph5Bjvs4BU:BFeaAG0VNOUGiJKlwpphSAQC32p0PJjA
False
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.36 KB MD5: 35aaacc751533734caaba98356a75300
SHA1: 51d716a1370bf74f06d801c43ac6e45b70f71501
SHA256: 03858bd1c1160c773f1793913d5649069896efc40f7999e2d91f7f7c8a5ddbee
SSDeep: 1536:7P7IxX+WhGmKdn9YpmYf0QHdxx7sQZxgRlIdw9tynwmxuLDZB:7P7qYnapmKNHDNsQTgRSEAwmC
False
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: cd556adc4f0f0ad47bacede4df9cbe3b
SHA1: 043c0f6ec41e73ab9dc77d4f65c1a338ad125e3a
SHA256: 6fc6282a968a7283f58c0730ed71742a3996ca1725b31093e61777c348b6fbbe
SSDeep: 1536:8k1ir6ixE3VlnayGTv4a3nqYob1khZHmPcq5WxC5W0GjexFCD+p:f1iOkE3Vla9z4a3+K8cUWxf0GyxwD+p
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00120_.gif.id-b4197730.[lockhelp@qq.com].gate 3.64 KB MD5: 8a40c84b7e8f64b77f4b70e7279692c3
SHA1: 2bcce5c550c45473072354c0359ae23921f68612
SHA256: 08ba9cf271b16b4f57500beb87708425dea7616583c8b98b7771a215c1a3a815
SSDeep: 48:sw//Udf+b2auzqz98Ng/fnvEZtDFHoimpLeTy+FJEoKBnK+37UQaKOIvjbeTYGA3:sdzqz94N7Ty6+pK6i6b1G8rGj7Q
False
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.30 KB MD5: ffc91b36c94a5976722ecd51b01cb392
SHA1: e3e81a9700ad890c6313fd7479ad4d9e707e1d02
SHA256: fa82e8db0c660db4a814f72c224533a0d9cd00eff5a3e4956260283d938badcf
SSDeep: 1536:qLALXUJJoAkojvmvhyTmK755NdgT0db53IUzrU3ktMu1w23WVa:+JoZojvmvoDN9dbhhMi13ka
False
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.33 KB MD5: e64db71d913370913c12f20d01ed89a6
SHA1: 0aa017820e7d93dc6cd63115978e1a7b5b731345
SHA256: f998319fb2a241d5660421e8b3a5d743a69132d1e11547c216fd3833691d5cfc
SSDeep: 1536:LsX/ruKpFQzr2ovyXpqXrUgSJIrVjWEr9/YgvK7:LsX/rXQUgrK+9/YgvI
False
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 0255e7bf30be9ed864faa2d5234766ca
SHA1: 37319c76ee15c07e215f07eb4ec8279574102586
SHA256: 57337238fae824548560446d6e0153a79aaa9fc3114eb06e8fadfa39ba156114
SSDeep: 1536:qocMN4VkKVVZ8HYS7pOUcM1GECpxhsQUZbFKehpoGAwxYl+:qHMNqVZr6pOUFGJLGPXKOpu8h
False
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[lockhelp@qq.com].gate 68.38 KB MD5: d41279984561a22af308b4ecf38e553b
SHA1: af036a89a2874094f19f10282d2d7171fc65cf64
SHA256: 07d414365c402c06ddeda55eec42ac41b07377ac332a35a1ea21f44fdbf35584
SSDeep: 1536:ul7/wRI51AnpLHg00ZoG+kVygsESK9QlwL7Z9/IxO5FJn6:ul7/wRY1gs008GygSiQicxO5W
False
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.32 KB MD5: 75f149616194de236c23cb1a9778e26b
SHA1: 329df2b9b25256b02a2a746ad7509f7615158d80
SHA256: 2ff5159e60c771a591d6d01093fd9908fad1016a1bd03bdacaccc2de61ecf3a0
SSDeep: 768:1oFHLZBKkRfJhwih55l2Xvu7sE24Mr2jeHMD3LMOyeEW69AgTXLBGWeHVxXytx67:1qge/7ZYEOf+69BTbUMP6C204CnnI
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00130_.gif.id-b4197730.[lockhelp@qq.com].gate 5.37 KB MD5: e98c3776d5b68157b19b901e94385eaa
SHA1: a8f22ffa34e81c8482d3221853b1ff94049560db
SHA256: 871ab0d1892f9e9f5c5112ae0b8faf473bda813c8dfe7138ee40e7e1e6fc19dc
SSDeep: 96:2M1yDQ5uK1dMc90ABEtqlrXp8DIgZegCOk/1lNDqMraqEGGqoIsNyC5Gc:kDQDMW0AG8Bu9egCPb/raq6dIuyu
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00126_.gif.id-b4197730.[lockhelp@qq.com].gate 3.31 KB MD5: 4dcef18c3225135cb2bc317262467d08
SHA1: 52dd49cf4e099114daff289180baa335a053c38c
SHA256: 2684e03295b7ca7aa491285baed29ac8cf32e8ddeba514c47885cf144e449adf
SSDeep: 96:VVVJozy099hbGV75msRRcoEuBLAXu7+r/TJKF8HBT:VVVJ8yKK75msvcoEuBA2YbJKqhT
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00129_.gif.id-b4197730.[lockhelp@qq.com].gate 12.43 KB MD5: 894d8d2f3d21e1636cc0a8540b71e059
SHA1: 8e96a766f135eb6422c0cb8eaddc97d91f28eeeb
SHA256: ae45fff3a06a4e7c0540ecc1fbb585f25f28ef647a3c50adf5b4bcc0de1bc254
SSDeep: 384:HHiau5Kh44/dLGziw9Gs5ShrDxEzBAMR7+q1:HCau5KhZCiy4tW9+q1
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00135_.gif.id-b4197730.[lockhelp@qq.com].gate 2.78 KB MD5: b7736a720cd0b9a308c6a0b1e1f9761a
SHA1: 6069bda3f584fceaf73038ae9e7628e2f8ebd785
SHA256: df9ef5a0ceffbef877c7f2fe786d134f1fd01ff3815d2784f2fb4e82ee6d43cb
SSDeep: 48:uiJZw5YC0nqZDbY3mnFhTTFkdR2hDaUzcPEOYJE24TRKM1qdALN6X0bn+lVcK:RY0nqZXkmnFNyeDfcPE82mRedA8kbn+V
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00139_.gif.id-b4197730.[lockhelp@qq.com].gate 10.59 KB MD5: f1f2621db9169572febf7faffbd57064
SHA1: ebc4973e2d4831c4efa8425135a86d9ee43cbbe8
SHA256: 791bf35ce235e5e3364ba4fcfe2ecbff48f4023da8555da5f408bb14cd7b8b62
SSDeep: 192:X6i13HGX0MzD0gno1xlA0mlm8sJtvPAV11XCRLDPpGHZDb68id4DDcEajzZ:XBmVnKxRmA8sJtvIV11XODBG5P656Dcr
False
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: ad9518562b5a51250579c7fa58c75573
SHA1: 091f34c1db47d45c38988cf138ca7a948092f04b
SHA256: 4d8f6f2d7715eee4d37c5e6e64b1a7054285cea2f360efc66750783863713622
SSDeep: 24576:h90eS9NkCN0XqQpmtv9PlykdcuCZJesGDP6GET9WAyxa1ZrR:z0v9NkCuaQpyhlIVZJvMTEy09R
False
C:\Logs\Security.evtx.id-B4197730.[lockhelp@qq.com].gate 1.07 MB MD5: d639de01e00b50158148eac65ef979bd
SHA1: 7b2ea2db881f6814cf93c254ee8096ca41f60aec
SHA256: 6b9c837f9db385e952816c0ede4d1059440ee57ee4789a8605b909222320f875
SSDeep: 24576:x07SwQlcY+ObmWFtMalmXVM4Pm2B67IczPnTyyRf3DyMoXiS7:SelD+eme5lmX9mrRTyWuoS7
False
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 1.00 MB MD5: 8a914cfb7d56929d77baeee15856f19f
SHA1: 02ecdb386b054d248e911f5553cfbccaa77063fb
SHA256: 0af8572fda995c219454dd16743cd3a541aa82f6f2fca0b37835162eb071058e
SSDeep: 24576:1AaILmNFoCigu1sni/oECBmIiz+mukot6VaSlN:/ILUFoC+1Oi/oExI/muLtETlN
False
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate 68.31 KB MD5: 3ba473d903900382acf360814a550aff
SHA1: c847017fe5fd896df4fadafa5bae7334b6c9ff25
SHA256: b527dc5e0fd3b81424679a731fffdfcaed9d267527b0df8c6b681340e616a08a
SSDeep: 1536:xdgLiFNnhUG4xflxEp5B7oe+edr0l3xdqxRl+2z89xN3p:xd+iFNn6sdNX6jalkZ3p
False
C:\Logs\Setup.evtx.id-B4197730.[lockhelp@qq.com].gate 68.24 KB MD5: 83806074de4e393c3dc7c0feee218d94
SHA1: 09d9bf772e81dc7ddf1f83b4a12f3ab417365a89
SHA256: e8c03cba6c35c3811812b16eec609fbcd5b0e37f2a2845db6d8f6856a63a4056
SSDeep: 1536:PtnsOMW1BZQ/UbWyV6W4ASpCY7XAGcGb6AoubySF8JmFOGJMHHQ:dhBBZmyV34AQAG8SymM5YMQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00157_.gif.id-b4197730.[lockhelp@qq.com].gate 5.07 KB MD5: dc1c56908c7fe2ed853994c702ba6da1
SHA1: 80a116002b6f4a360ccb555e102a3b966f78965e
SHA256: 4b182edd35b6faa30c3e403e32ed982b7177abd23ca78bbbeca35cabdd97fbe7
SSDeep: 96:T4SzjSC+tOO0iaLvffIL5cC/rPh4VCHM/6JcSwRPxBonulOy2CxS26xQHhEgQw:TRjS1J0ZLvffI++6am6/SPxBousyVxS8
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00142_.gif.id-b4197730.[lockhelp@qq.com].gate 15.18 KB MD5: 10749e2e2da4f13fe31f4d569061cf80
SHA1: 35ba864d58a973298b51852babbdab3f3a7f0a4b
SHA256: e6d195b611e26add69039197af2af3804aa18f45ded7465c8f883db2f6ac6330
SSDeep: 384:6U7y8ORhsDXgZZg8/uYPVhisnqJ2lbf0nOUHTZfB3QgKVof7d:6QpOOgZZgNYtPnqJ2lwnDHTPggL
False
C:\Logs\Windows PowerShell.evtx.id-B4197730.[lockhelp@qq.com].gate 68.27 KB MD5: b812610f361008c683a1f01602f2abbd
SHA1: 35c131757ea86df93074cc52db5d7761c45afad6
SHA256: 9ebf1ceeeed173062285de161dfe32fdc09b4089e0dce55e9f2032377c556956
SSDeep: 1536:l+9PRIKCm8I7T5BUV0hdQjQfi3IqUBzpiEzKCN4cIYgWUJ5:l+FCm8Iv5BUVSK3szAEzbNYYgWM
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00160_.gif.id-b4197730.[lockhelp@qq.com].gate 1.36 KB MD5: 355b6c5de69abbec388cebc718c4506c
SHA1: 14d2a62f099df0cac3c183532e70a82c02c4a611
SHA256: dca2442627bbb261449e944e5065d06c1a9b9314484acc039c2c440d2ced4948
SSDeep: 24:SJPuBuLevmbyfz8TuHWWJesvw2AOKJUCiXfczY5:SEuiKP6vw22UDvcK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00163_.gif.id-b4197730.[lockhelp@qq.com].gate 7.06 KB MD5: e73584957f0c48f881904c8304b4ca85
SHA1: d50fa08181aa31ae9b1b25cff0e521cab4647fd7
SHA256: a77d34e3f9378c79e79064806b088e3a290a8a365dcda94e1fc2469ecec7c736
SSDeep: 192:A8b5L/T+QhWjLBFxB+dNmKGwncUizRNN5i0C/N1old+5jo:A8pKQwlFT+P9Gw9iDziF6dKs
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00158_.gif.id-b4197730.[lockhelp@qq.com].gate 5.15 KB MD5: b9c7486c7c3076a44f1c7a6d28ebd576
SHA1: 2dd40165944386078d09fa55a25dd7f2a6c86a81
SHA256: 321fe18bf0882bbda9eea15b0465ac546082e36279ca9950b06cf1ffe0df965a
SSDeep: 96:tdcZdbeH5Od3sDKcwKr4n0rqkp1QMUxNsKP/3R1RAJcl6P65eW5:8yZ039W42q+hZKH3RkJN6Ec
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00161_.gif.id-b4197730.[lockhelp@qq.com].gate 7.64 KB MD5: c40f7d28247628ce7b90b5f66a572fa4
SHA1: d985a9921d141422aa441492df0cf066a9a8dfdf
SHA256: 9e456917cbb2b795110ee99e2fe7418bbec2dc254bc8a9eaa3ebd6ba2eaf6b0a
SSDeep: 192:HMdpcC5OH6Dj8b914QF0ohqc3HqNzPXBhc2KWrRm:sdZ5O9914QF04Yl62Kx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\common files\designer\msaddndr.olb.id-b4197730.[lockhelp@qq.com].gate 15.86 KB MD5: 1efa57ec2088802b77aecf8fca09441e
SHA1: 52974684b4125547c88d0fc7f1fdf534da0714f3
SHA256: 1604d52ba963604d844dd16f7bec5953b29794c735fb401adee66862c387c15c
SSDeep: 384:nM4FfQHy41elTrVjSmv6twG/ueVZ78yNXcAcLMhN:nM4FfWyflTrVjSrX/uCZIMCLMv
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00164_.gif.id-b4197730.[lockhelp@qq.com].gate 13.18 KB MD5: 8388286e473553f15268b1aaf233322d
SHA1: 5135382f3448cdd1e5775df10c538f0508211226
SHA256: 1f8711c98f785a8aae038d2c7d6234d690914c2ed6db2b9143a0b4ad547bb804
SSDeep: 384:hR24ZbMYw8Wqmv3/7WedwIgiEwP4V5NfANkUtczd7WrQpA5RbL:/jQYkpf/7V39wfANHtkd6rO2/
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00165_.gif.id-b4197730.[lockhelp@qq.com].gate 8.62 KB MD5: 5e5d76273e2148920c63c5ea200b796a
SHA1: 71bea84ba15cf4b0d91023d615f3694556645b39
SHA256: 4adea2650d6505dbf1370e23cf440b19b0edcfda10aa6ec47d1a44dfdffe4cff
SSDeep: 192:OFRl6b2j/qsRHePTm3oRwDNSbuyT1xNo1vam3DzIeMaBJXbUiw2qt:Oob2j/qY4a3rQCyTZKfQH2qt
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00170_.gif.id-b4197730.[lockhelp@qq.com].gate 9.28 KB MD5: 276bb8e12ec4859161317259303b5336
SHA1: 90071e3d771a975c5e6e8646ed968b8681c9e7d7
SHA256: 46f3fd5c3487dcd4944bfc95fc5afd6349703be9a29199f965b54f54ddbc7222
SSDeep: 192:a3dNxS/IecL4xsHmR/eAUTFpcSJcKfpbZp+Wc/ezEGqrGX2LGyO8:u+Iec8qmR/eAUTFusc4Dpxc/ezEp/LGQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00169_.gif.id-b4197730.[lockhelp@qq.com].gate 5.48 KB MD5: b59c0227aa7a46ac6ca93cec7f60f168
SHA1: ba96a86380db4580dfaea7e5c85e26c5dcfe7fa4
SHA256: 0d53401dc2667fcf43c5b3c685bdedb9549f7275792765c89293fa9cfa93d52c
SSDeep: 96:O++f/yQ+cAH5Zi6PA76y7CKl2Vcs7Jo/jIAFb39DvPJAQFW892lRK3LX1ZK:O3XywAZn9TIgcyVkzVX/W89Vz1ZK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00174_.gif.id-b4197730.[lockhelp@qq.com].gate 4.11 KB MD5: 2469d74ff1d72fc6ce2d87b7da3190f2
SHA1: e09836df3be7124b071119170e65ae222a23aee2
SHA256: 3e9565471f2cdb0ac6ac5f1f667c15fb8426e59acfed33de9d3846f26626c954
SSDeep: 96:2wSPtyDoF1Tvxd3r77WO3c1k+MJxNkmvDGcBdr:29PPvvz3LW0c1krhBV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00172_.gif.id-b4197730.[lockhelp@qq.com].gate 4.53 KB MD5: 8d1b2d71a4bbef762f82f039f001c945
SHA1: b28bbe705a962e0f86fac7f02308c20b23b8b684
SHA256: 814c34e585601a3198a4542c1bc59fa213eac3406b4aa4b87d8ad34cf784db1d
SSDeep: 96:HbYehnnOFZR1cYPLLhoXAtkoaz60WhFTOU7T3GHoXCWYgFSRhNTF:HbYehnnO7R1cgLhoazazRyFOm9CXgIRl
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00171_.gif.id-b4197730.[lockhelp@qq.com].gate 5.14 KB MD5: 01f8010d981493e469098b24945fe191
SHA1: 8c3d7fa0a610df5aca1c0cf2c137fe9b68fbd148
SHA256: 7bed8f804cb18e606115d8e83df4a7b2d1b8649bd162e22ab765feb6c08d5e4a
SSDeep: 96:nLkK5ViiEsHCP6hrBYDkTlo83zvaRGS1PHeeW5nVSk6:LkeLEsHlrW+WRGp5z6
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00167_.gif.id-b4197730.[lockhelp@qq.com].gate 5.01 KB MD5: 68460d14bfa022bd32476ac800151ff6
SHA1: c0c089f027ee39af525333746ca6f7de76dc151e
SHA256: 4b2bd967b4b958a7006f2ae4f07e003fe60556a837269aa9143b63abfecfe281
SSDeep: 96:ewehLhoH1oYCarostyS+unHlX1qHkFRTD8SpXKfWI6kGNHyD69ZVYmD+81WQ:XEsLCaro6+2HllqE3TD8SpS6kGd9BYm9
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00010_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.20 KB MD5: 256dee37d9e524a5b794e0913ea02cab
SHA1: 8e6d6320e201bff54f3be80f45271e8643133ff0
SHA256: 90d42fc242367612be4441fd634a3abec4a64515960686d2ffa22ea47cc58fcf
SSDeep: 96:3BggvYNqE/SA19joRwP525QLEq6lpwYGbqAsfo:3BgHq6s+LEEYUqAsg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00176_.gif.id-b4197730.[lockhelp@qq.com].gate 3.29 KB MD5: 6e6c52a51da98f9768826f5638729ab6
SHA1: 85268ecab6179452ec152f7e0072946b2b551bc2
SHA256: a1cd28db42b42f3cc27227e02070bb6d1d2ef9d83d830e4e0c1c75b4c310868b
SSDeep: 48:rrIZTz55UYIm2zPB/jc09DA6P1mt/vSUm1WA33Ey27oVR8Al8DHSPQn4gS8MjlnB:gZTNbIm2zPB/YNvtm1pl9/8QaYQAJB
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\ag00175_.gif.id-b4197730.[lockhelp@qq.com].gate 3.54 KB MD5: e3ac49ef7040af5c515768a28096dc91
SHA1: a1ba0e72748462ed543a77aa4b269c05cb273e33
SHA256: ecb0bc4bf0846a2a9fef5b6f49259b4741656d2c4a44820c81f5081e2ff418f7
SSDeep: 96:IfGCL4tQHFXB/+YK6V5vDALl7TklkTpJ/n1ku:6lp+YKaDAJTSkTzD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00853_.wmf.id-b4197730.[lockhelp@qq.com].gate 20.34 KB MD5: 77f70ad6f1975c53fc75508301d5c47d
SHA1: 5f5935f83cd73be85dfa2987b9fdfd29f09d82ca
SHA256: f0377669dbc5dbd577d8cf9814428b056d96a1fa0d3fd16566df835381ce49a2
SSDeep: 384:GtWvcTMIgRVNJt3/MfVvF4xlLXUIm5/ISazjRjs/gfN4UDWKQvy:HbIgRV6f9FO9kI9FFspUDWy
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00914_.wmf.id-b4197730.[lockhelp@qq.com].gate 10.82 KB MD5: 1236ff3422ea304030a989de588e45f4
SHA1: f7771499c866723b9eb7d509c58bd6a9d2383b7b
SHA256: 83bd1f2530d8f069063fad5bc0fa66ab74a5c720587d0669e08b5526ccf3a355
SSDeep: 192:byhTxtOYRumerTwFMG30rathc4oqi7Qm14sEyDOmrsCGYxFRb9jQ8S1NW/QJdfdU:bWT7OeIPwh2as4oqi7Qk4ssmYClFfQ8f
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00015_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.86 KB MD5: 9c13df20f750d8d6fd43bd081094d347
SHA1: d3026c475dbaca119110f4eb99506b9d129032fc
SHA256: db5d4936a08c13622ba74fac624738552270a75cc3a6a592a5c9e28741fecaad
SSDeep: 96:VdzMH1DZOUamR3IEuz9d+hyz1E6s8V4bnP0vZfPpgHIdn2H:w1xTdFIZBE6sorZXpgZ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00790_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.79 KB MD5: 86ee425ac6c8253fb8631bc3f333b37f
SHA1: 6096528b18af115bcbb5393909f1744c9dce062e
SHA256: c50d9800961da4521641535ddbd75116c8230074bad634c88708e37d953f5148
SSDeep: 96:s9AdvAvbdRzCs3kjrToQ94L7cE6NPDBSTw8yXFbblWabDrM7nn9TTh+w:xvALzzorZyUE6xkcbwabDInndh+w
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00932_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.32 KB MD5: c508d3498f4f891f8e826c1f30c574d6
SHA1: 0873d9b4677b66c94d08f83a91423e649b80d2b3
SHA256: b8560a5529b8bd10471dd26b9111749c8c39714491fb7cea509bc730218599f0
SSDeep: 384:DxWT+owTacAOxeH1mY+vnaFa4yeTWrBEIfPw:howT7o1mYIn8a5g0f4
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01044_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.79 KB MD5: 9e6f0418498d64282751ee2ccd27d5b1
SHA1: 5fde145c82d01e2e32e7550c8f89e4c914c192e8
SHA256: 39fdff8ff74d62ac1303a9fdecdae9262b986c32f3292b6e11caf093a2378b8f
SSDeep: 48:aPCUDgJAr3eyLU3tSOBpOsDGrSSV7wqFmvzL6ecqlJ/sPcK:oTMOeuQbBpOsS2qvOCkDW
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01060_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.03 KB MD5: 7f0cd688bc165276bab9969a3571c18f
SHA1: a229ed55890d47ac748be926001ece1f1b383556
SHA256: cf804c0e4ab2367b2408313a4f6df19f33adf08a66d4250b9400d4183053e2e8
SSDeep: 192:TtnqYkCmV3IStHLVfylo+vRYL6b5gaYNHgxNvL:59+IStHLVfylo+iLHpgxNvL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01039_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.51 KB MD5: b3e0971f3861c20b8611f8ce7ac0df25
SHA1: ebfbd7fea03633582bfb65c753ecb3b3b9ddecb4
SHA256: 3b70530226f80bb470d632f29f2ce81cd32185505e2ff5208a08cdedcb977d92
SSDeep: 48:Cr1H0xgMR1GIAsAkbLd7Qozq93I8I/DiynxpFKex5QBcScLHUrMNPx2zFd3N/EcC:C10xgc1Ycbp7I93pN2D9SE+zxd3yt1Cm
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an00965_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.15 KB MD5: 3fe2f24fc1f5611174bc8be6fa49c245
SHA1: 191541ebe734afd931117fad79b0940017e58b42
SHA256: 156fba443cc0266ff976326040d6a4f2854d53d08b13ce88c57fd3ab1eefd604
SSDeep: 192:Fn6vnXlmZCovk1jaU3IWSd/wAKGR1XMQJR0mB+Tg/BOW:O1mZZKj01whseUy5TgL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01184_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.90 KB MD5: ddcdedb4cee77af08bc61d6ba3a97640
SHA1: d5c047246f82fc89c175ac5e24f3fbd068815a27
SHA256: 0e9ad0b6a5bfc6cbedfb12cef3850b2b85fd26dc304f7a9786fb76bec3593bce
SSDeep: 96:VphSMdIrH7O+1cPBDa000y4GfCiV75Gb2XAbU:Vp8MdmO+1iw0vboVqg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01216_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.93 KB MD5: e19d8ffd543dc68d4f7d3c3b0e556833
SHA1: eb0b19f519f2d010bc21aa279ca0ee2e79b9e78b
SHA256: 878df0c6af384f5e69eade166a8a8c4dfb7fd9ec3b3eae68cddcb2f0b388d97e
SSDeep: 96:n/UGZuJFCJ8RfGCELaoX0HfBVS2X59P3zmhQ+tMcOM2Lrm2a0Ykgnsl+xItMBkm6:/UvCJkHEOvpVS2p9PRCMcOMgrm2vjgWP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01218_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.18 KB MD5: 482a9dd8aa88691913cdc63033b492ae
SHA1: f2eeac7d1e724146559707d10850cdb8694b180a
SHA256: 09d5c9e7f8e51711077056a97f8ab755e935312ef4f3c8ff14e358ad009a1fa0
SSDeep: 48:j5K8gaTPAYEsRUFIv5F6L2Y3jc6e8G2CuPnzfTiaDuuvjloiMNcK:jqeAYz8L2Yg/9qnjTLzvjOx3
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01545_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.43 KB MD5: c5edeada280ec73343372cec09101785
SHA1: 4a7dd9dfb4067b19b1504455960c9f67fc0ec5e5
SHA256: 866fe0f864b70a0e33242667842c780fe137c2a168490e28b15fc57edc943a7d
SSDeep: 192:3xcfs+oChp1Zwj09B0DLSyn9cZBbzDXg4Js28EvRcUezIZwGe:hcfsbCh3ZacGpSZpf9y28EKzIZwGe
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01251_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.93 KB MD5: 01771c67dc84cc3fb0894e32e3e4988f
SHA1: dafaa67d0ded44f5a291ebd9fddf07a5f973b4b0
SHA256: cd5be2e28baa0145e48793e08150f89fbec113879e0531f6698b739d98afb063
SSDeep: 48:4x8+U45pV4SBv0FcG8mUvmA5dsf5ay43XA4wPt50hIudOadVY0SSgcK:4x8+U4TWSBvucLmUvr6f4nQa0WVQSg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01173_.wmf.id-b4197730.[lockhelp@qq.com].gate 25.95 KB MD5: 959b709aaf5856138e01dae3f2a1710b
SHA1: 578f1ac39dc48144c3f051bb59ff6c97eebb384b
SHA256: 278c3d88ca523e563ea027977a105b3b81b0bf2213760da5faca93014be7c84c
SSDeep: 768:LhZo7t5W/DaFLtG8pgucv4Ky6Xsxa2Zq/w:NZo7rWLaPG8prcgmMaEqY
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an01174_.wmf.id-b4197730.[lockhelp@qq.com].gate 27.45 KB MD5: cb37e4f14570646f26a35946423c4539
SHA1: 84da7333d8bb4f51e6860ed6f523dc5b5e013d9e
SHA256: 07d0aef71c78aaa1708cc0a10ee3249bcdf2e8abfcb3abfdea3df470fe598caa
SSDeep: 768:m8wXi+L1WFn5azDYFwvl/J5/cSRBR7nLMZ90HaZf:mZi+L1EHF0/X//R7noPbZf
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an02559_.wmf.id-b4197730.[lockhelp@qq.com].gate 6.71 KB MD5: a0f2727714287cd99951ee1ba90d34ac
SHA1: 8010289b5c5110462f87ebddd8e5a7cc7f550e26
SHA256: 6abf14ee913443773ba1bfeff4ea907959bd3e190913f4cae626234bd9316c29
SSDeep: 192:T99nerfBU+sfjW6xooSeJEXBwufFnDOuhFr:T99LWoEXBzt
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an02122_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.61 KB MD5: b1cf2157cfc212610c71a872880e1cf4
SHA1: b71dbcaa35ce205af4412270267048885cb4344b
SHA256: 40744ce84b0c7919d02e69fb3ff52606223710b3c3e359c0cf947ca6a8283e93
SSDeep: 96:NG0H1tz41Q68MdGQbu7lOhMGzBpfJNSr9Xx4YQIwjMvVK3/ujuVvkygYrBHxDD9L:c4VS8M4DsMGvffSPQIw+S4yqBRvA
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an02724_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.29 KB MD5: f7b3a57ec590ff7b9efdfe196a245f5e
SHA1: 26d8ec32c60f0b908d147f9f7fc093bd043545ec
SHA256: 56bf9efb374df88bde135f280578f154a14b2d340f416804703a275a0f3f9a51
SSDeep: 48:ml2JaiSeivgLgpOzWjzBGpg55jsLthtpLVZAogzBOX9TRDShZcK:ml2JaiS9YXzW3BGpDLtiokqvDShL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04117_.wmf.id-b4197730.[lockhelp@qq.com].gate 6.15 KB MD5: 5ce629a5c731a9258fe0b2fd30394a53
SHA1: d1166cd64551d7081947579d3b088311d6991806
SHA256: 5792ceeb7343e97c0b5a410e839536167f6ad76067bcf19a541cd02ee61b214f
SSDeep: 96:weqhGg1xfAkLq9gG8jjv1NWsfsA3eplS/4m0jIGaSzbaxkBS3OXjFNRrPd1:nbOxfq9v+r1NlfXeplSB0kGBbaajF7z
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an03500_.wmf.id-b4197730.[lockhelp@qq.com].gate 9.26 KB MD5: 10a59e71c28938a2c4c8259a6016ecd0
SHA1: b6e5cd17d2577de70f72b66ba2f8a6f43ed7dfb4
SHA256: 78288b6acb86428eff2835ce2ebc3f1835dea17169df70dbcd9bbf6806fdd8f2
SSDeep: 192:eJP/faiIqDd0ylNkg8IhnVQeNGy2csAighfQtUG6RTfu70jo/W5PIvy5B6ng:u3ii6ylitIlVQPyrNRhfu70M0wNg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04108_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.53 KB MD5: a4b536e3cf9a153c589729573a46de3d
SHA1: a5975316196ed95c137c1e1ddbffd4d0b028c29a
SHA256: 46cc1ba0c4587ad0020400822d407750cc8f7f7f4c886da6457d3b05819d0cce
SSDeep: 48:roXZS5qvLih9GC8lDuRrwEj/Y6ZtyP8RYEEal4+BBL0sjytJXJzEM0N3IGcK:UXZy9GZ0kYZtyzaq+z+tJX9EnuO
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04134_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.57 KB MD5: 4f0e7a0a66b77d45211722f994f49c40
SHA1: 1fe0f63a93c9ad577837f792362180a3ba86e309
SHA256: 92cbac40b86d6c4724a29ad05409eea3db11adbfbb2ddafea79ace38cd9e3579
SSDeep: 96:+bHTB6Eum/vdHWkTbVFCip2n6J7iY7iIdcECc:+LTjDxW8bml6J7Vazc
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04196_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.31 KB MD5: 6f08fb45fb3d88b2204054da2a68237b
SHA1: 2f92ba7c2bd8ed6f49d6173a3886f534d5163a40
SHA256: 7bcec320a543d7440ef2ae2de622200a2071e4311ff353fc0c3ed512955037f9
SSDeep: 96:Bgcv/AFc3Pu+F9+8CPlfNltEqOgmVOgQU9qKLTUIR:BgIZ3W+FU8yfNsqI0gUKfUIR
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04206_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.73 KB MD5: 7874e2814e92d72b0baa231d456d8080
SHA1: 6e80ddb95fc53fd4df4a9511ec892f73fa348b59
SHA256: 37cbe7f054489774ce1a5a735e784c8c67353185d286081056168463e3f573fc
SSDeep: 192:gFKyjob2OOaEiVrxfvuO+F+dwjvXr2adW3IansaFv:gFSXESRWW+734saFv
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04225_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.53 KB MD5: 4aa2a1f3d7f1904ac7f083aaebd9fc25
SHA1: 05766749044f584af33015b7cd7461a1d17d06b3
SHA256: 37c9e21bf121c0a29adc963bb88a1e83ddcda3701fde50c226949d40bb4b7426
SSDeep: 192:COa/c2tT2Neg2EMH0pxvFts+OA7Dya4At7T3pfXwKHC0sf3AUyrlYRjwGLvg7q:fa/cYT2NepRHeJR7Dya4A5hXwKi0I/yu
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04174_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.81 KB MD5: 445e367e2d9ad8c7327b25e16e4e1b82
SHA1: 6298ed68e666feff84f1332f8f43289e62db4cc2
SHA256: 5b0c354a689ee97193ef90cca8334e69e540610e682068a8b1e364c132ea8b65
SSDeep: 48:cv5f+RKM6xUs2aZ5CNTRONMuYgmV/FDofXp2FfhBrsETW3xY3ciI86kHkd0ryGDG:U5bUs2OWRONi/xk2FfHZ64ci56dnGpk
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04195_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.75 KB MD5: 00e7f2720db29c8376bba5b0f17354f0
SHA1: 67a22068c899381d22d330cf56f7e045930fd025
SHA256: b8cfd192831d3d61016ba7840a79af58c564568ba84f79362d6b9c5887f7d839
SSDeep: 96:mivQPOZ/a0WVWKrlG6wXly3hzv/h/+9DCrtjU2I8axI7KF:xvQPOZ1WG5XlszX9YCrtIr877KF
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04191_.wmf.id-b4197730.[lockhelp@qq.com].gate 6.71 KB MD5: a406f4bebbdc227217e4a2a200ad7c5d
SHA1: 39413626c10ef834c21903d07e24cb346a2f1b03
SHA256: f3935e1c38cc3228433f9740c4e536f33ddb5786bb64423e3ebb1cbc12e7179c
SSDeep: 96:nqZcvLKt3V/m+mX9d1jC9e+/DWjXprT8dIEu6aQaV+uzk9IhPDsIavHoLn3k:qavy3VWbC9MjXKu9VT0I2O3k
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04235_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.86 KB MD5: 47d43f6309557520dda2ea6754891d93
SHA1: ea1a68837d9d598016301094b0bbda7ebf28bf64
SHA256: 23ef4e7700f5d37438f9cef456d29e46ec5790de5d78ed5165896c9825bf6a7e
SSDeep: 192:IbUDHj6rRWk1g0m4JbHDTP8lpul4U3yDWQGkE8/:oU/6Fi0mGPepQcH
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04269_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.21 KB MD5: b06e7588c6e1de5539ce8b49818ef85c
SHA1: 770155de9da9158e5d75792a306618f597e414e4
SHA256: 7aef08c03ca776a3e05924961af7457ff30568777ec0ce9ab30b5ed96faac489
SSDeep: 48:6P9M2y3ppwePRUgmJNOeAsyuqglUsRI2cK:MM2T46gmJNOKyu5lNT
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04323_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.67 KB MD5: dce24d4934f42772878b02e9fab4b39f
SHA1: bf14af27efaea8db5e932925f34b4a0f9e51a175
SHA256: b38a0476cb61e97174d5d4f6611dc87234a66ccef38e6357a10db3ddfd18fd03
SSDeep: 48:Ss+BFeIP2HYq7lawNJctXFTWlSp4+ao3AWgM9bdgnslfN6/wFUzLc5nq6Gu/cK:ddHYq7ldJcxZW4pjJAWgad7KwWz6nao
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04326_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.51 KB MD5: 76771f988d2860ee4b22c003e357a076
SHA1: 85997c043670232414107c69876a4eca8acd6909
SHA256: 3a1729e903029b2474e287142a3eff934b2b05987025a1cea3a07c52fe73b5cb
SSDeep: 48:d//FieQIecyaToNJJm0/svj4SaRgEpg/ZnC6/N1ahGJ18qSmORz7laziEJ69eF1V:h/FieQILlTb0SaRKK+18RlUoo8IHTv
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04267_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.86 KB MD5: c728e58ced2a7b5a8e738697dba7dc60
SHA1: 90a27875b81fa863bf52683ab39fe9e20469a7a0
SHA256: 5748751dd8ea31bfaac8f91cab865acaf54c0fccfdfd88adff1eeb12a9aff639
SSDeep: 192:Bm96Bj4tGYj6+wiqMBqKpJMWiWchGQWncMG2:wG8teBivNDQUG2
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04355_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.39 KB MD5: 4c8cbad23461cb78cdfbcdc9b5a65b39
SHA1: fea60e6f9663cbdfbf81a86abe52dcbc65fd89c2
SHA256: ed30ac64e03aaadb4e3f606467dd5d44f2273a22aad1ea6f80432520a0aa3239
SSDeep: 96:cTFTt28ajk9wW6Q9Phw6Q4R8Eg/AEjI16e4U78Zx:sSDjSwW6shpv83/b8ux
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04384_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.12 KB MD5: 7367c36260722c9f104241ac0a847905
SHA1: 2eeb89924e948c3292393524f307190ed75e6275
SHA256: 2902c49e6be52db8077c65d0210165c3ba7d35d8fddd394800bd488c528122f4
SSDeep: 96:SM8Ty4PWSQKD1/7O6mUoRxMWLFEfLZ+fAB1jObXepqtqbjBKqHJHeLB:18XPTdDhC6zof6tobup8P2+V
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04332_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.43 KB MD5: 48393fd5b4835699254f4fa996552121
SHA1: 7448e8fbdeb78e80b8df5a1d4109dc7b4d54d319
SHA256: 02691f8ab9bf8d030d576f9ace6606fa59bec85f48237084dc3a14cff4d15a59
SSDeep: 96:QHb3P5Uago1lo4BmlVkLT08FKCbqUj7ZDS7JZ1pn5Eg:kLOK1lo4AbkLFFZXvZm7JZ1pCg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04369_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.93 KB MD5: eb66c00c9e082234f0ebe5d39520a18b
SHA1: 4973e68182866cf68855f99d394925d8e7ba46bd
SHA256: 03f23c88b808a8b1d8d11c43aa447511e412287e70c0017bb69e1b8339414014
SSDeep: 96:Y5pR/A0ZpAQlOlAO0ECrNWDDAHy97HdS+doG6iwYm0snha:cpR/DpbjEgLH+7DoGB5sc
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00116_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.00 KB MD5: 0a85ea645e790c4233b62735f8cf2cbd
SHA1: 2560552dbb473b0aa362c280636752e1c4739121
SHA256: d72a2daf41b88eba8665226838dc069d5df448d75dd6df89bc186aa33b9a308e
SSDeep: 96:BIAF0WgqEU6IVNAh53oSBuBFasOP+Nqcpa0SbgAEZA59+DO3SwKi:BIE0WnEAdSEBXcclSbgAEaLr
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\an04385_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.12 KB MD5: 4492302bc9d54c5412a629f1695e84b5
SHA1: 3fe5b31334e77c63ecaf31fbc9eac30ea629254b
SHA256: c0babc061c16852bbd0e9aa76665ecc7f8cfef029ee3e4bc023c861711f78ffd
SSDeep: 96:iVXm8EcHz3uXyAKTJLI8rUmAwFcAlcmhVzRfszzDRfCQtmdiBvQWOj:eXP3iX98fUhocbmFoz1fCQkdB
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00141_.wmf.id-b4197730.[lockhelp@qq.com].gate 26.50 KB MD5: 63474fffea32a8f901a8b7ac1e783383
SHA1: 0d459fd82446ec82f6cd391a0ff46243ff3c3d70
SHA256: 8b573f3a8368cead8b9c43e6b941de9f0eb876f91e9965da050d576a5d61ed1c
SSDeep: 384:LHCWLvzR79ML8efZqGbWf0+bsgAG8zVpczLXQlk30TjZj2Xk6dKezM72zLKPhi51:WEr19MQ8WtbSc3gl1tH6VM3JUlR
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00146_.wmf.id-b4197730.[lockhelp@qq.com].gate 28.51 KB MD5: f106ac192d660484cb6d136031e3030e
SHA1: a5bae5090dbea4bad021f2de4ea6ae519a43058b
SHA256: 9f912a63dc2a6fc502fcd2bc39dfaabef3ec8294c526bd84829af8ff37e2e71a
SSDeep: 768:fh2F32Qak3SHRRJxKzWW+k0bYYeC4PBcRejLvx:f830RRPKCW+kqpij
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00160_.wmf.id-b4197730.[lockhelp@qq.com].gate 22.23 KB MD5: 0ebe3fbb3ad8b8e6ec3c8fef5fc46ec0
SHA1: 7dd9bfb00db12a0958ff09df68a605f6bfe2ff0f
SHA256: dee2203b18d5dc619ec6840d4bf44e412d45116740cb8d4d4ccd7822faeba46f
SSDeep: 384:O54cE9SQ3ijlsl46MfUThGbCh9nZk4W75I5EomW+woy8Y2L3MT5D:Om/j3AlIiM8mh9n24W7AEodnp8/3aD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00155_.wmf.id-b4197730.[lockhelp@qq.com].gate 11.61 KB MD5: 0638c13ab6bbf776b7e213c028f03af3
SHA1: f8eca98b7e89080a63678cde063f3678fee24091
SHA256: 91e43ad9052aed6752ada97a661bc15bce6f893f4d5c4e6a167e3b4b75a16304
SSDeep: 192:DXCRA004aY1nU2A18TNZykGMsW67/lBy48VqOkv7ywSXC41tkxpLUeW:Lp00QnUyBNsWKlE4MHkvu/C47kxp6
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd00173_.wmf.id-b4197730.[lockhelp@qq.com].gate 16.04 KB MD5: ce0edd11465292be8cfa991a1cb52126
SHA1: 51fcce729a5ce9d72099d23e2cee28ea2c101799
SHA256: f80979af9ebce66b9b971e9d129c9a1429d594d5ef20f41e2299a2f660f889b9
SSDeep: 384:Gq9FuIzmQO3wvVghOpqpyleVgy5AOWiNzqhmNQmee/cU:GMFu34VwyVy+OWJAQmeucU
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd06200_.wmf.id-b4197730.[lockhelp@qq.com].gate 16.53 KB MD5: c995892a0c3d486829f00ecb20c19409
SHA1: f135277ddb995268011f9a8d3e35ecbd91f333f8
SHA256: fe6b93557d53f3656035012de66e0347cdbc9f86339445325cede81f9153f1d8
SSDeep: 384:vaaDkQZH6whND+dkIp1szGQSmCq+XHq08cVOwP1OLVqnEXJ:S05ZcG8sVSpZ3qXcVrP1mSEXJ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd07804_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.04 KB MD5: d20dc2a71ef3a56049233e06f3e94e90
SHA1: defa0646bdc5623c904811d74204b2350ca8e3b5
SHA256: 26cd46abf19ab19b400ee412a580fce5708778cc92d6438113a54f7cca918822
SSDeep: 96:OPVIEhqZaDGakdxyVdPz9N9gj2Nf4N2k9dcwnUqrfk0A9s7m+3MJ:O6EYfa+xymjq4BcwnUufAs7m+3MJ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd07761_.wmf.id-b4197730.[lockhelp@qq.com].gate 26.36 KB MD5: d46db46a689874ec8d6e9fc3ad7e5b6f
SHA1: 58343292d18ed74b39c56b3216b3a25d2b2a4f9e
SHA256: 103dbbe531a91c8d8ea6f6c8a2ea121334d8b92342911729aadcd9dedb7f7d4a
SSDeep: 768:Ga7FEMd3m5GCTCBr6XW8xPk9fEL9lTmM1xa0Z6W+:G8fR5WjPk9f69lb1xay6V
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd06102_.wmf.id-b4197730.[lockhelp@qq.com].gate 15.98 KB MD5: e3cd7f6c9c9e04a98a3708d597d5e389
SHA1: 8bba94933b5cae5179ce8d03ebc383d5a71bf929
SHA256: 0b6ba3f90f7420493c9d6f6be3ad12951f80bede99a325f3aa77606a0e66ab08
SSDeep: 384:y6u22nHbgl9oVnaNPRoF0nW2DkSP684NtO64sN61DX:yDHbQogRbnWUPiz4BlX
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd05119_.wmf.id-b4197730.[lockhelp@qq.com].gate 17.07 KB MD5: f13ead58c5b8690182838ede8ed424ea
SHA1: 1cb4835d16862461753c3f2a6e777ec2a8702774
SHA256: bdd928a842614f1f82bf12adab572b816f008272d71a43f0cef8da58c71ece3a
SSDeep: 384:CFctC32V62n0ZJTqO+Mmm06zVc5/PiYkUsAZYMr9MI:9C3g0HTly5IUsQXhMI
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd07831_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.21 KB MD5: 67d09f985e43d55a380abfb62aba9c28
SHA1: 0b2f83b336cb2985e6c3b8658da7ba59a2d1442a
SHA256: 5b4beb3e94d08ccf1e6d4c9af3c1e7a05c65162e1038185b737a991d0019dd22
SSDeep: 96:UW1mpgkt9cLC+rb1zL71lz57u7u7/B3kJ3Wzs2veZS5W:7Upt90zHh7Eu7/B3UmzsT
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd08758_.wmf.id-b4197730.[lockhelp@qq.com].gate 24.00 KB MD5: d85fcbc50aa0b5f1009b2115cea74e18
SHA1: 0582e84a35b2815db93c235dc1925281aab68f39
SHA256: b2ca30532825540ce6ed4cacea5f07c95084bb1d72508b9525c39c2f98e66d36
SSDeep: 384:U16aD+A2ZJoc02btrWpTm9YtjUO2YNsymI0CwnbnqqcKIZTGsHp7D1rfkRcmEY0k:UEbAsjLprWhm6tjUnyrsr+ZTGsHpv1Qz
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd08868_.wmf.id-b4197730.[lockhelp@qq.com].gate 39.50 KB MD5: 08ce6eadf2e4fabf6b9dfccbe2351d09
SHA1: e496ae991fede688ade648bdfbfe12f1805630e6
SHA256: ce1116dfbb67d4e7634ae06a21e9c78b42f3701709fdb333f291154ef70a1189
SSDeep: 768:LOCWgUy7fFLh/PQXSzDwKdY88xTyopkrDJyckNdlrnI2UlHvsEJ:qCCEdU2cEV4lrNEJ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd08808_.wmf.id-b4197730.[lockhelp@qq.com].gate 47.11 KB MD5: be5b3fa6d19b80a38f4f5466208f0393
SHA1: 0cca52fe0de7cb2a363d6222b8a4baca5555c1d1
SHA256: 98a445b980c4a4d2e70b493d85676eacc02ee66be82703cc6a251953b95d900f
SSDeep: 768:u9hjtGspcef61nMDQcVsmsDrIKLXcoNp3IJnFkJwhxRXDAIqo3rw3P5+0TLQSD:Wpc261nMDQcVsmsYip6FSwDRBZ3rw3P9
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd08773_.wmf.id-b4197730.[lockhelp@qq.com].gate 24.43 KB MD5: 3de71dffa834f97b94166062b2328c8b
SHA1: 37e7ff94296c314f2ad1f96dcba6941736622498
SHA256: 583388e8f6b2152ce67225bdb3132bd6888536a3067fbce808513cd15107686d
SSDeep: 384:Y25U2f7K86LqayeheOdDNoHXXo5MPzV7qvf0CV6KsGVIzIC5TWjx1zcP:Y2C2G8jayGdunaMP8vfJVkZl5yHzcP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd09031_.wmf.id-b4197730.[lockhelp@qq.com].gate 46.90 KB MD5: 3f6753d5aad269a0e24957e5277b18c6
SHA1: 970aa4953f45d1a5ded4d299fec39cfd648b7248
SHA256: 1dbd73813cecb038a9ff76ae4066af8ee9dd4d73aeffc8012541a9cbec6e1402
SSDeep: 768:On7WbF4URPwgdh9OwKe1gsIS3mgNPDAgzGqD11qbkQ5rbCTTo6:On7WbOUhPBrS47DAKD1MTUv3
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd09664_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.01 KB MD5: bf63998e8fb89a27253f12a90feca392
SHA1: 5a772c5c712527ebeecc277b1b676d6733e42d9f
SHA256: 94041e621f80e4001f5e3ba535893faab3d2963668dcf178422446b5faa72423
SSDeep: 192:lQnDaacQBzz3XOD1X/hwHKzoJAU7bmWGCtGZpTAO6ptBo8z+qSg:azjlkhhJUnNaOhptBdX
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd09662_.wmf.id-b4197730.[lockhelp@qq.com].gate 20.31 KB MD5: a1bcaed88e4781418a5d53fdb752258e
SHA1: 67dae567b5432923862baf68089293d248632009
SHA256: 3ac70afff8ce0737a28803a8211909caa949a0c480376bce20b7980b180afb40
SSDeep: 384:oP9GZIA6oS/ehUtX/aAqetwS0cQ4fz3I6GfwsAfOuf2UcJKfvLuxaz:0S25/e7Y3pt4wsAGuf7XLl
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd09194_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.43 KB MD5: 50630e7f0f5e5dd39d3e3b66c9c0ab58
SHA1: 8d876ac979b6a9c4ec60b94d0d92f64d8a64e823
SHA256: bb6e3b80f6374d097c1708b24e50a2cc87a8023e73fde0a520d1ef904549eeda
SSDeep: 384:IqOQ85S8MTLBjlH+X3sbtZ2tnKU/2yj+1PBszxjex3ooowMtE+:b+5oYsXhzwzxjK3ofW+
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd10890_.gif.id-b4197730.[lockhelp@qq.com].gate 13.43 KB MD5: 1a823aa16aed6f9a5136794d6f6199b6
SHA1: 56ca6b28d62534d76be4d4d7d8ded7b93f8d5364
SHA256: 78d3aa0501b85b5584efd9ee04101b2837a0d3db2a8418e4ec124c1093b5144d
SSDeep: 384:fv5VeqPANFA/B1YTVyoujo+614P6i7pdZLQUB6:b1PA3k+zuzlXZMN
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd10972_.gif.id-b4197730.[lockhelp@qq.com].gate 19.95 KB MD5: b3b40f60d6cf5f0218b3e0e6c813dcb0
SHA1: 2c754e4df2e119135badd35a9c5fd29c72fb0019
SHA256: 8495615ceda96b79a0a128fa76d1ad58f8a7e6f326a29c02e3361962a77760cf
SSDeep: 384:JEu8E/TOxXVlaDC+i8zcmv2kHS8M6oUJjYW0HBX+ZqmLzYef7iSv6hyYLxfpEVV:zrbOhVlVfWcc2qM6RdnIXTmLzYA7JSt+
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19563_.gif.id-b4197730.[lockhelp@qq.com].gate 20.21 KB MD5: ec60d0c13224c28e780205715168ac6f
SHA1: 41b25aa55ac5e58bbd221b6cc458f99f551232b2
SHA256: 9100c0a6a79bd6612d4e21b97b0227dace068faadf6236c1193996eb7fa7874f
SSDeep: 384:t/wP6QgNf8XShGvK4hDeb9ey6Od5lJZT9e+Y6jQRsakuVnzg/r:pT1qChGvdDy1d5lJJ9e+NjCRdhzg/r
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19827_.wmf.id-b4197730.[lockhelp@qq.com].gate 9.71 KB MD5: d8a0c6c8bfc6bb21233449412739b709
SHA1: 67a8490e48bba7a259bd8c22a1b11203bebbe780
SHA256: d734a733b569f74d3255924a2ccae7c58fa1a401f715066925978aa69d5a1d37
SSDeep: 192:7K9guWGeJh2r6BCR0nk+p85HAYvac9aDvWelxdrATE9WVC4L:7GAs0Cynk6SHAYva+lelLFWTL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19828_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.81 KB MD5: 9399b2ef2415e77625f93c8167e6594c
SHA1: 5550b2010ab38f450f311cce3bd797ec9ad0d7f0
SHA256: f2b6b2ee47ac13bbba5d31d68be3f7b6dce56c837b05c0eeec86f4d8039626cf
SSDeep: 192:vPZzSeC2qfodpZw8qGSE/KSl6prhwvf1wx178aBEeVrGuwwQX4E:XsWvw8qGRSSl6ptL4aD7wN
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19582_.gif.id-b4197730.[lockhelp@qq.com].gate 15.61 KB MD5: 7bbfcf137f666ef612c9300c4ace8da8
SHA1: 0e37f2e21dbde4a5eca79f83d7f7d81ba2ce987a
SHA256: 2f465b12c1527f932dabe75107e5966cd698dd0f60e2fb8d2333c4fdd51d3709
SSDeep: 384:uT9Ak1MU5qJoy5pfSgb4ebIlguqXvvaHGgk0vkR4ElqnD:0Ao8oapfSIdbIlgfXvCmg3sR4dnD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19988_.wmf.id-b4197730.[lockhelp@qq.com].gate 18.12 KB MD5: 70702fdde937ad2b4f57d9c951541b88
SHA1: c729823da10bc87eb54ccbcc5e6c4d1f0fabd15c
SHA256: c0e5fcbd1ec0bb1ba6ff39e0379f9239a6e028e4d993b57ce4cac35654d94f53
SSDeep: 384:1XnpepHE/H9zyHuTvRLaWKMd/o88RaDjAumSLL4tX12DBl5onD:acH1yHuTvpaWKs/oPqjAkL4tX1iGnD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00008_.wmf.id-b4197730.[lockhelp@qq.com].gate 12.46 KB MD5: 13353e9e0bb195011a6d9f3780e10385
SHA1: 70dd09adeb7e013219b6e23991af2799394d5d97
SHA256: 273e2d60d38459d84f3ec943c0224953edde47839c8eaed0b60430af7b0b53c3
SSDeep: 384:Oa6JAG2GJv0WLOV3d88VQtArZAIU0/j2EHmhi:TS12LWLOnXfSrQ24qi
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19986_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.39 KB MD5: 388881226189942afe9990578c40c13e
SHA1: a1a0f4310986970b4c7cd9fdb2b5417842c1f7c6
SHA256: be3d45f87132efcd52b2742208ac71f8c6ccb6f931f6158694f2ecc0f55fbe12
SSDeep: 384:sKpL7zopsc7uKCTSfhKnxAX+5FxT9wz/S:nLZouqfU95FJ9wz6
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd20013_.wmf.id-b4197730.[lockhelp@qq.com].gate 11.04 KB MD5: 7b195eeca1df6ead8c27b0a1931990b5
SHA1: 26613751ce9f6fb1416867730bd0e6af682cc281
SHA256: ca36a7aa0df75dfc80caecc790a651a655f322af4df382a8486e97bd0a85cb95
SSDeep: 192:gcbQchc4oGxpU/Mq+FT/hgknDIn9XJNsjpLDjSU52RS+RWfdBXnSOapF:gcb35Dg7a/RW9XJO/jSU5tqGlTo
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bd19695_.wmf.id-b4197730.[lockhelp@qq.com].gate 12.92 KB MD5: dd9171e68348859040d0080ee38ebafa
SHA1: c38ec7b326f790b9a75f2d1671d1f7d270cbe795
SHA256: 900d435fa4c8d2c28d91f331f022391c904b17aabbf607dc18df87f241c962ac
SSDeep: 384:w9A5rLRHu/HZZtItKJqkxlVDhDrHhOBTAKhnVL93Y+PiW:flRsDQCqkxFHhOB1VLDiW
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00012_.wmf.id-b4197730.[lockhelp@qq.com].gate 9.82 KB MD5: 914aa3156d581260f47c867e1aae0969
SHA1: a161af66850ea2391f8b444d134df60454423b3a
SHA256: 19ae70bf63ca2acb0e2dd64371a37694760e7c03b2f18a762a129f4d4aa25f74
SSDeep: 192:GsGXhg2Hrs4JeUBhqEuItdoUO0swW5e3ffpbWvoYd8Lq9wBs:GsEHrf8UV2UOpevRb2a+Z
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00045_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.92 KB MD5: 5a5a9ae12061fc89868f02f3f754b1f6
SHA1: 9c354c049209f9885f109a61e4524d4237014338
SHA256: df58073a511d38ec008765a00c3862e06c6d5a209bb56ea1d11231f6d9d0e292
SSDeep: 192:21nPc4ZvvV3n04Inanvh8QXx1cOTlKj92CWstBbJJcz/ij0:sPcYvVX0dTQh1cOT8j9zB4j5
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00098_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.23 KB MD5: 3959afc5444cd7d90a24afe3d9781075
SHA1: 9ee9d3b95db48497e5b745aa3ab669e09374316b
SHA256: d3d1688e95ee7f7f7e4618df07fade52d4c070a53a410c5d6c5e3ac3848a7c8d
SSDeep: 24:uF/gMvO80WdxqolpZvztHvCrqbWKXFikUiwFqccLwFQXKQK2sHfczY5:BMvlqmZvztHOqbPikUBFqUQXKQacK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00122_.wmf.id-b4197730.[lockhelp@qq.com].gate 10.15 KB MD5: 231ed12cabf657ffeffd8d5ac03662c8
SHA1: 481ff3ae557cd4e927c08688e6a78ab8e2fdd60b
SHA256: e2eab2294a7f93e0484d9b3de072191e402a225bad4ad63279bdde19599c3e41
SSDeep: 192:D6stHfrHF1HNawCKvpoPTCijQI5jp6P3x6yqBQf:OODBaw5urCi1Y3xM8
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00152_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.71 KB MD5: 7392ca29249d7c1d1267c72b4fcaebeb
SHA1: 98726f9300b84bae2c3d0fbf9eb4686a0740081c
SHA256: be512a1a2568cb5ca458d6da3c2730493c10227e59c50d1173bcfde6f33b68d7
SSDeep: 48:pAMsejxYbALY2lLNLncx8IPP3BsTJxOkWG2CDLAIV+cK:DriQNc1HBirYIE
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00130_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.67 KB MD5: 77c74a90b0709cacb306e059bd73b3b7
SHA1: b63c65ec2314a2cb893b647b614275466e7d7a58
SHA256: dddf6f47842f89d95bdf60387c95dcdbe35ff2649945a27e1b7e606bd5a4d0b8
SSDeep: 48:Rfcn7MeZZvaE1gMLK9IQypWw4g7H4tUdVKObcK:enoNEGMQypuUdjd
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00105_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.11 KB MD5: 7cbb74b8f41027edbff2f5b46afb709f
SHA1: 8314a49a5acc0d95348e1f8fcc4253ceb0f6c3cb
SHA256: a44d5445d91385656e71d201ea4194793e6e634f71c1bde9cf19adc7944887bb
SSDeep: 24:yEQwYcgLTunefRslVeJOIJpS5tq6xlnhjfsp9NMfczY5:xQwYLTmksyJ336xLj02cK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00194_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.14 KB MD5: 67eca41f721eee3894d87dedcab29963
SHA1: 3929a7a4244cacc29e250a998cbc14404373be59
SHA256: e259e01f7a764ea444f471407d73d91489a4bb265f644bc724c8ae07959c3a02
SSDeep: 96:+fL9A0nAi1BP9mgiK5DGnyIrjcs3rTHd6T4bcekrtNRguFw+V:+pAcAeBhxhGnyAPHdQOce+7LV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00148_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.90 KB MD5: 416ab53ca5bfebb775a203d55e81311f
SHA1: 1038c7a718dcf2687c4ef8bdf0bb08bf2920048d
SHA256: d9b6fe9fc8b3ed05c6f6e1bb42c0e78619ef6388d80e6b7924c1286be98a8039
SSDeep: 48:Q/tVud7DxNv3zmJAMQ9ZwBJFaWzwGsXG7WEzYLJcK:QvQ3nbmJAYjaXTG4
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00195_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.12 KB MD5: 84ceadebe3f8dc602a8bbaf2ae471cfa
SHA1: 50f161197c91b975294fbe6b5546f3704fbda149
SHA256: 453e7ec2ca744e7f1d1689956e5b301645cbc1a3e34ec7e809bcff653e09193f
SSDeep: 192:hw34FrWWmOBLjeQZz5I94vdN5f0FXURk1NNF1yUgpLX48YTI0T:hw347BLjeQZzC94PR0FXUe5byXlRSIY
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00248_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.75 KB MD5: 2b59f895ac3f2f268cdcfcb90638d776
SHA1: df0b737080a5382acb0de65cab598bd266007f1c
SHA256: 9f213913d390f0fefb1558dc7aa97a33fbbb0733ed8b0ff72077fc179d19e758
SSDeep: 48:FOcmwiD1R5CLUCQF39Uf5g8C8PzwD6fBycK:FOAe5Cgt39E5g5L6fBC
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00247_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.34 KB MD5: 4b88149147b8bb7126a2e087375bde58
SHA1: 63380f607ae30384df91e4bef118c8e565ecc0b0
SHA256: 625afa6b84e38647d27c14985f3e9ec5013b823f1d60bafab146b6de4af2f333
SSDeep: 384:wxelQSos5hqhV4Xsux6USABcv9yQkCf2gr4AUjy9r:wGQDzkdSJgQjug8Agsr
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00242_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.17 KB MD5: a217e0401c28182c35fcf31ac5dd5db8
SHA1: e81725f4a5139ea95cb69dcaeb0e79681463fbfe
SHA256: da79e8bb2fc4cbfe5afa80ba6883f46412076c5d802f27d776a8df8f66b156cd
SSDeep: 96:X8Aaqg/t6AqD/nntBPKZwz+/RseMoebhJ+ygddJqeo6u9S:Zaqg/kAqmZwqRsWetJVgPQ3FY
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00234_.wmf.id-b4197730.[lockhelp@qq.com].gate 9.32 KB MD5: 9f4133fd174a07090913750125ea3ec8
SHA1: 2aecee18169aff1ef251a3968de6a4a0f5a6a553
SHA256: ce6543c323d278103426a13e3f50275116fd8d63ac6d9ca76bedfc8c3dd65fdc
SSDeep: 192:HzWrNUJN0z1Ww9ZVly0qPsYKRoLrc5ZTyTmdWzDVgAXXVHh:TeNY0z19ZVlyPPpKRoXc5ZEJdB
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00254_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.93 KB MD5: f06fe63311f59a83f052e9c9306e8091
SHA1: 2bfe64aebae0d41131fa9f2a6ca7552888e7dd75
SHA256: 0b316c39d20c262cc34e9658d75304fe55c10507803824646ea8014b22686b96
SSDeep: 48:55yYVwD9uO7mSTso0NdPoWfzJq868LHv1VCcK:+804oYoW1tP1Vy
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00252_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.84 KB MD5: 56e526c9e884b135c7e36c3820864d64
SHA1: 50c029d39794bc3e8b8f882c15e1ae46c154aad4
SHA256: 518fddf453c40db8b5d3b22c449716a7c1cdf6e26f73f7e69a1d3b1380a5a25b
SSDeep: 96:olV9Z/4wP6FfrFfI/n6xBjSWRN7ECgjaRAEtTX4aOzCcd8NYWjZ8VQDvF2:U9Z/pPEFgCTS0NRtMaODdrWl8VCvF2
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00261_.wmf.id-b4197730.[lockhelp@qq.com].gate 12.43 KB MD5: d25c4477986e41ead30b25c5c77f603f
SHA1: 3d0118610b1a775a926bbae1382b6c47048ff7b5
SHA256: 2203590e0be7f63c99bf5074f1936fcca94ea257f52a2b25955a7f5627ab5843
SSDeep: 192:+gHjTOVp2yP9GRwgsWwec117UxL5NsyB0183uaeFGUrkT8p21AJlhsjknG3Br/4:jvUcstecn7UxQSj0Dkop1J8QEBrQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00265_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.86 KB MD5: 77f1e4b47ff3f8cad138257b21dc50c2
SHA1: c094ec34b34c490b047a0fae090dd035d6a3a2b7
SHA256: 9e24dfb49a72a5cc7f20cd3aaadfa6fc9dcfa96e90924eaa531dc50a60a05a77
SSDeep: 96:d88VD6iQkC1NeewntKUucRtcFVAoRFR1K3ACo5x/ArSGzl6PQO5A1sFdEFUXUOI:db3NaNytKgRtmAEJ5ChIvmGUn
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00262_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.73 KB MD5: 626d4cb5684e3df6ec6012766f9d37ad
SHA1: a6c30920e49d087b6c8c080a9e4f0bc1250ad588
SHA256: 89920d938eaf47bb0b0dc0beb768ac9009bcca00c846c454e64a3c8792643a5d
SSDeep: 48:tDCIR/eX5cIau34O/xEcdpTL2CPJzgX5zflVTzor3osE7yqcwZUukRBsgrjO930k:tDCY/epLN3/xEEL2CPwJ9V3obtE7yhuV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00267_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.82 KB MD5: f2d91940f4c51078e9842444f2ba1ecb
SHA1: c60c4307f74874b70f4258ffb4210af825219e83
SHA256: 3982c4adf3e0a6a52972ea38735037902b97f4f8bfae1d47208968718d727b7b
SSDeep: 48:UVH0tJEhPrOPzYfyGhc4nQ7sxnFvKZqs6PreWvqwE50+8eE51XuF4cLjiz3GjcK:FJEhP7Zc4nQ7QnFiZq9TX7E5PEaXjM34
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00273_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.93 KB MD5: 8c13cd538d39ba78038412aeb293bef2
SHA1: db98ff6bb3cc996e8ff4e1cc54561b0c25597e35
SHA256: 774f9078e818ef8edb64edaebcb89f58782f09e3dbbbc2b1eedd1685fbf8ba89
SSDeep: 96:cymAL69mgx0SCiQyNacVvfcBLqOnBQpIfIla0JSqgpF0N:tL69TxNQiac1fKmO2pIfUJSqcWN
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00274_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.31 KB MD5: e1b67ab05cbc85ac3c00aa63b2c0061b
SHA1: 7a3e1de149665e4bbcf25d609b378760890ba766
SHA256: 966c342c6ed4b2e59a43eafe46d5943226a91887edf1e4db579b516736a7cdb3
SSDeep: 96:bR/leKkHN+UEgPHKe0qnTSuUEtyivgMrc6Rvqr1vuidN:bRluN+UEcrTgM1RIDN
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00270_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.18 KB MD5: 20c41840d70e13d94fbcb7b23398911b
SHA1: 0aa94d972cbadebc0d84e2149ea55afcb8c3e58f
SHA256: 0c5990f974149a9731599dfb5a041ac0c502ef7d773a56c229be8174a9e9e377
SSDeep: 48:C7/zkEDjP8kebIApfrwnNUSF9Hq1+x1bIZ8irPhN/uZaRH+L32phFIFJvOJpzF3B:GkEf8kaNMiSOCa8+JN/5R+0+vOzFx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00269_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.39 KB MD5: 52d4bbe3bfc041aeb2760ad6d79ab41c
SHA1: bc95eef65633c1b5aed61fe3442a68dcb1b3372e
SHA256: be5a6073fec355e08a6f41cb265832f00d3445bb85e2bb065acafae4144de338
SSDeep: 96:w4JUBtAOK3XYerDCFSYVdPZJXRyE26EMbe9jV0cnsdM0CKnk6IRCF8k4p/T:xnXJr2FSeXEtjhnmMPKnMRCF8ke
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00524_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.07 KB MD5: 3968a5a42b79b7089295082ca72a03d4
SHA1: 3fd6ba9c2dc12a8d2a707f035df93c0527f94af2
SHA256: 178c9e54e6d8bcf9475b279c4397d97db5bd1ad96df90ccb839668ba118a4248
SSDeep: 192:Syg3y/6mRODFjWvtO3rjFI3Tzh4pbxLSuMzGEBMxpsmyL+GG:SygiSFjWv0/KTV4pNmzGeMktLc
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00392_.wmf.id-b4197730.[lockhelp@qq.com].gate 26.65 KB MD5: 79e7f151b857594a449e21704f9e7760
SHA1: 51653679a37922de7892268e5b37111480f48e47
SHA256: 34885618ce53653487523ddff1f824d9a74b184cb7a817a1d8754ba289d6ec46
SSDeep: 384:1Eo9oGsyuLNy7pbHI/veG28sfggGK3F51ycunZZ5L9ENNEK7IhcHojLgpyUu5c:9hRn/8s5H1YZpaNNhIhUoj8UUu5c
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00390_.wmf.id-b4197730.[lockhelp@qq.com].gate 13.03 KB MD5: 63c3f2434fcbb48536013d6d1c36c342
SHA1: 44d6093767467f31da4c1c7ba698f82e212bb582
SHA256: d8cac3084b1bcb87e1dd7aef68669446fc2a93f57830db5beab4772c736ec9a8
SSDeep: 192:RcpNc5A3woWvMyRdK9bsJtfSgPbdFJVAXNp2jYBMAwpIC24f/8A2PW/IHQo:RcD5Iq9bkfPbAXNpvBMOCr80Po
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00648_.wmf.id-b4197730.[lockhelp@qq.com].gate 11.46 KB MD5: 9d36ab2b46d5e83acb01cf4dc13288b0
SHA1: 0b1da0f8e3736b0896e37ff40634496c89c3a324
SHA256: 10460ac7e96cb7981fa954464d95437a86bfeeb6251e9cbc01ac741f0f010dbf
SSDeep: 192:Dzem9UQKuOwW1R11ghynNfIP3WaQ3fH3W6Ezaks3wr8ZaWEuM0e4tclj6Fq6foyE:DzePmOt11ghyfcGrH3W6DY8ZaWEMC9Cm
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00932_.wmf.id-b4197730.[lockhelp@qq.com].gate 19.26 KB MD5: 7c1577b337731c156746f8c43fb0bc45
SHA1: 7a1e77d3de0dbe356570c3d9096c86a850efb91c
SHA256: 703621418d4510298a1d280b8ab5f3f115cb0df299ea78d202470009974c086b
SSDeep: 384:EFNhWPjUPQGTQRoZKAWywsbwJtOdUwp8bsxMZmZNeiWR2:EFNGYQRowAGsbwJYdS1mZNeiWR2
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00985_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.92 KB MD5: 50230fa302f91db6babd6dccf1bee7eb
SHA1: 7d0908dc9cdb5651ab90bffce3ed8c62137360f6
SHA256: 7b2b1d78bf42ec09b4f494adcf63fd0030fdc10e5417b7395d45cc5b6162a9f4
SSDeep: 96:HXUvhIucW08XSyJRbgdV0NRdbIdoTUAiC7E3gjV8D90z7U/JSN:3EOX8XRXEkNRXQAd7EQjaD9goC
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\boat.wmf.id-b4197730.[lockhelp@qq.com].gate 3.50 KB MD5: 8659287035652e10ca3f8b42b23c6f57
SHA1: 0878eac46a6ed5ecc645d1b569fc4bdb85439acf
SHA256: 6f47d9a694b0a847c6fe53350cb09f82dbd4f24714bed14b58f044ef10d674ca
SSDeep: 96:r9l1L2ptBdP9OMlmCx8hQ+2zAnbQ5l6bByStE:pb23VMMoCx8hx2cm+jG
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\boatinst.wmf.id-b4197730.[lockhelp@qq.com].gate 28.56 KB MD5: ad657c8b821cb634998b173c07057aea
SHA1: c0a162a46662404d2ab732dc13f91946d0d38de6
SHA256: 548b2776f54a8a0cd656a1b1ce49bd897ead138390c98d1ce28537ac05d47d87
SSDeep: 768:0b0t7Pjk4q6tOrUvIcxcw9oMGB8RW78aZPalE/SB0bZ:rt7/v2UvP+U/RVMTA6
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00076_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.54 KB MD5: 6b9fb67350fbdc92f90862f95b8e4ae7
SHA1: 67fdf2123e1ccc13702b47fc0a2fcf3423bf4316
SHA256: fe7738c44cda6b5a565e930d4b61c70eeea95471e41f3a5589fde5584ad4e625
SSDeep: 48:VjvQ9qmtrt6UNrFt8OoOlUCQcv0A1uB8QhqcK:VjY9V1rt8KUCQcM6uBrK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00923_.wmf.id-b4197730.[lockhelp@qq.com].gate 6.36 KB MD5: 2f837dc680242dfc76ff4b51784ae2e2
SHA1: deb818fa5da487b751096b0456fe805db4419f52
SHA256: 5aaeb868063a82ad888fcbc838a7bf27a7d1867bdc9009ccdc10f386296c97e8
SSDeep: 192:EWd0/9/bpGvNZahWgu7XwSETHlIa8HyrLI5i:EWu/9/1Gv6hWCTlIaFI5i
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00921_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.54 KB MD5: 0c247c13448ff62158275843fa4ec91c
SHA1: 2777520764788b90d86c479aad288c91cd31b1e2
SHA256: 4a08f57ca7e3b1513e95056f6fb46d82bd5b5336cb4d5fcc41d8db27fb0028c2
SSDeep: 96:Zar4IoQYU7UKrtYy5ZbzY3m+4YtO7ljuGsC/ZamLwC4cw5ikt6:IMdkUKZY2zY2CtOZjJsCBZLwCMS
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bl00526_.wmf.id-b4197730.[lockhelp@qq.com].gate 27.15 KB MD5: f027ba46d3c7ddb5e86ec572da346dc2
SHA1: a2739ecdd75e992511605cc0981fea95bc02143d
SHA256: 15c8e5e7de897520e8647ffd6c160209fb1d0e493b4d2fa4886e807f2c637e84
SSDeep: 768:DyYnHunchGMZdlOnH5JLPn3XDFP+sZSxgvGkt3+ny66l:e6KMZQdP3XxPdZSi/t3+lQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00078_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.65 KB MD5: 7c042057090c4437ce85c928d11c1d32
SHA1: f1bd7e19b6b5056b211f6940df2e0369d00e0a9c
SHA256: cb99e7fb92478db241fb3b3dbb68ccce7e974f0e9536ecc19824989bf618ce9c
SSDeep: 48:vxx0MrN6X09GmKMh00SehoVWsiCBMLwOuDTncK:vxx0SEXCQMo8sCiV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00100_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.56 KB MD5: 2cf247566f784febeb71939a44909478
SHA1: 72c809e3b2a6450deb677fe3eeea7aac3c1caf6e
SHA256: e8853f1e4b5908dd5de29c5d738716640a301778b8d51569896058e67a0404d3
SSDeep: 48:OmEgNRakONi74Vg4V3JZXIkS8gg59YrrL30sJ1xdjGsoYYsPVbDfK238Yy9cK:O8H374S4FYp8n5wnksbx0sVYsgSyH
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00135_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.26 KB MD5: 870db8125a741f6537d7cda8052ab8eb
SHA1: 16a6495bb8e7e96429ea71e6049eb4235e13faf4
SHA256: 1f86c913a7a08cd87103bd81dbdfb8bae01c09902f2678649d5a684f4eed4572
SSDeep: 24:ef4COD6MbraXyFejhBhMoccLgAJH1PxjLfczY5:RCUNejhBhxcc/PXcK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00092_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.03 KB MD5: 847937076fb8cfe1740c928cfe064fc8
SHA1: aa067ebd0112141b1c69c10b3b06867e038795b9
SHA256: 6e1cad05130832d70ee969812b0dbf55659d454fb33875827a9eb8e2309bd4e6
SSDeep: 192:oWgTGjq211L/WWyb/bNdrqYOR6uMVWWxI1nx9MvW:DQGjqSG/bNlqGuM5E8W
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00136_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.36 KB MD5: 9885d1ce58a523d4a44b82e2b88504b2
SHA1: 019ee25306829ad88e4f5616852f381d36d96f29
SHA256: 094ff66abdc980e68d66c1fa9b2d8004ddffe8331c8fb67090dd5cea6ceb95fd
SSDeep: 48:/IbMUiw7dGn3kdEit3c0QTP6KmHVrDb8kjrNGAPNXccK:/IbMwRG3EtMDm1/b8QRRPtU
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00174_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.40 KB MD5: 47bc061159063b1c1799d324b4841115
SHA1: 97a7ed4fe902fcdb5c3d898688f2a7e571c016fc
SHA256: f23efbfb69115ea81476ec9fff33083552e23958b883d7b85e3412e4f451942f
SSDeep: 192:i6a2oeuzFjzPUBfqqe0uv2trtDJilNn6yrkgDeR0E+iKx:i6xoeSzPACqXuv2trJy6ywCeR0rx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00184_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.11 KB MD5: f4038bdffb68153d799e512f2c8433e3
SHA1: 28b772172128d2b0e8485ca69df4f3ef96374430
SHA256: b1c86a9ef790ad401e6919377ce764efbb15d07c845e0b9fec5d32e2d27cf200
SSDeep: 96:kSMZ5GDxcYwCLtwE6O8VUQOC0KUMiEgUjkiZ+ZtwnM8b9r9wmekigggAShXprp:kSyGsCxaXUStUMbrgGXb9lf5rp
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00224_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.79 KB MD5: a81b592ff842fb4f0bc2e7ff803ce4a8
SHA1: 50ca3357ff0c6461aaef4dbb1c4298b2775a990e
SHA256: be92f61348c31e5f32939e45ae24d1bee77826ddd70bea93cfd63b69097aa0c8
SSDeep: 48:xR2tq8k9VtyEl0FSGdRKVMI0Oypz/1LEOTw+AcK:xRFXtHutd2U5/twF
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00145_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.92 KB MD5: 783480ffcec1c4a1e7ea0fd61f26f2e1
SHA1: f395787dbf327a92af5637ce401a463b32f3eff0
SHA256: 124e945622bd4e2618a6d8144aacb4ddecc7d44029f48376f27e666f41e737ba
SSDeep: 48:1RxA39vb4Tja9FNf3O+GIZ45Xe/J/CKyxDAs8cK:1RG39vbcja9FN3fGB5O/JHym
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00186_.wmf.id-b4197730.[lockhelp@qq.com].gate 12.73 KB MD5: 056e23369aa73d1bff95118e4591f69e
SHA1: aff012db96e18c1bd381266d6a9b11aece4d89c5
SHA256: 9cf40e16bf59b112b2c7099b502c73deb2f1fbb45e5c7a3ce1d00313dbdb3195
SSDeep: 384:BaMACi3kc18d/Aig1/Vm4SSTjHRCtNcKi2p/YBgZRpyhJU+C8e5m:DAn3617SV9X/AtNLi2pQO03CDE
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00200_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.28 KB MD5: d30961e72c8f732759d1cd31f6fdd920
SHA1: 1486456492a0e76edd98a8aa80fd3326f15b4917
SHA256: 747130d521fa30977f2045149e9f06c1a1ef853fa8f008adaf61577abe948313
SSDeep: 48:xQ7n6/owJNirEsSojWsBcFiJy2ycQwTSjxRCmbhZUcqk8aqLh+Omt0BCTyXp/i+A:lfJNXoCoc2pPTErFsIy+NtDyZFs
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00438_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.42 KB MD5: 925fd1014b873cdc5808e9fc3325da20
SHA1: 79aeedf951d2be51710fb2b4a244a833a39db1d4
SHA256: 85f41d35ea04502599a9733d272c304ceabd0f6c5575251da38d2329f13ca6ac
SSDeep: 24:Ew/nVemVJIVjwZmkQXURrx/6Fr8nxLYbppQoFBq7WnkBAGvzyCfczY5:EcVedkZmXURrxCd2LMppQoFBgvzPcK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00439_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.25 KB MD5: 15322b955ae0ffd2b722f6eed767c635
SHA1: c4cb833b3dd40ccff8e9b9cd726e23455641cdb8
SHA256: 0bc907c2cc3646cad0be770817a4b0a5f286543be7eaa5d5a19d7678e4aa84aa
SSDeep: 48:voWtbcopn7EdauCDyvqlFX3hfMzJiJi6sJ5fjqHGVhy06YkvxcK:Ppua3lFX3usJOJ5fqGP5kb
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00440_.wmf.id-b4197730.[lockhelp@qq.com].gate 5.68 KB MD5: a2e8dc06052156b034570ff208385337
SHA1: d535f36f529b8adeb970ffb3bae75cfb80783e21
SHA256: 3e6acb4cbc76e3d726f402e622cbfabbdc11d8abc1bc7646ee3939f00744f86c
SSDeep: 96:ioQyfBIoxl+DZWRaMsdUidwD0QsQ797gWtyN55MGYiPgriO20XUCU3xcCpd:i/yfBIoxkMAMg5wD0QsrWtyLMi6iO9k5
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00443_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.87 KB MD5: 2b68baac1fe8aa0a3a6ecbf772fc2871
SHA1: 3f7482dba137559a40f25e638aebc896c96dfe4b
SHA256: 0f90956bde77fd5d5f93a69d9755002ffea25795b177ca94ce88eaf2fb63afbc
SSDeep: 48:ux1RWLjL4GJ7/7/iht3I0+G3d1sXeEkaPFFUoB8qblB1qcK:S1RO4GJjrivrsuEkmUoBnlB1K
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00441_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.68 KB MD5: 8421da0665df9b44b41641eec0d4f463
SHA1: d23cb1f6e4c95c976c7c5db964272c8511ce0c71
SHA256: f66b59e7357c54e3574eb3c7b1e978d900296e4cd0f7acce79a258a2d62febdd
SSDeep: 96:NvuOtyfIJej94uP23G21S7++YYHJgfZrE2P3zW431:NvuOtGaGuS7+PmG9bWW1
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00442_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.67 KB MD5: 7cb83f8feee56e073cc56a370e14c0f2
SHA1: ff1a017db3dc0c4056b9f1223b164f5d3e72d0ce
SHA256: 7f293ea5cc7d6a7ae358525a1aa5ebe68b2cf085054d8ac29449a298aeb80159
SSDeep: 48:XT7N0GvqA8c1Xk8Rjmg730EyyBESJZ9dweGo76oBOR94uncK:XT5VFHBzRIyBE4ddL/BQd
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00445_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.95 KB MD5: e04e4a12a4713757a4e3e88ea9d264f8
SHA1: 7befcc3a38ecba65e298537088dc2c3351bacaa5
SHA256: a8db86de74e50096472c994c00676d40de0d519a772486d7f3da636d7a6f6e87
SSDeep: 96:Mbc5TvMhtlFo0zgrIiBcmIhqrfqq/WnxnKLm/ExXX8ETGDMLcbKi+c:8RbT/gUiIIenxKeEZX8ETGYLuKc
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01080_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.90 KB MD5: f23a60ae6e263691380141e175f24fda
SHA1: 8d7bc10aa412d64b0881e3e835f88b9afdf1fbac
SHA256: f63032d78c3a13af963a84d2d479d85f1917310a4438b85d5a9bef48c12bb712
SSDeep: 48:Ko8UK44rJEw5SriYCDI8TPtH7swUN7BPpJJBYBydJbvGs3RGRskzilyeZ2wKJEcK:Ko5Dw4ryIgtgdp/dtJGGkzilyk2wKJs
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00444_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.04 KB MD5: 7abe75795f596f26c03e8128e1c751cf
SHA1: 5d13cd520f47a69769322a4263bef899854de99e
SHA256: 05adad628e86034275409c9f9135f95697196034891dc60611ed5f51590bdc81
SSDeep: 96:QvmRPZyBiIKG3e2NWFT68x456wtaoB8XHU0KJEM4sb:Qu2BiIhHc6yu6QlA+Uw
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01603_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.25 KB MD5: 716037dce53226d7f14019b83b2f06b3
SHA1: 515a7a8a2b8373987e6fac777087b250b505f61e
SHA256: e70b800ecc8ec12aec3fb29550508646253bb4a41c96a1a01fc6d596f4319c2d
SSDeep: 192:GORNGGkgNecZWiuPw2MJRQsHnpWhJo0UVpEAbT/cUV:f3zecsiuo1HpWHo0UVpEAbT/xV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs00453_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.62 KB MD5: 6046c6370e4c950a314f1f4280c45c81
SHA1: 1a1ba0f480611bd15cfdb07f4ff41c63c911d842
SHA256: 5c5eed24fb8532c7b5b0d919e2cf2e14b62c9fa7ffc14be58ebfc30e118cd2ec
SSDeep: 48:4Ll8XRztn07RcAVOgxfWGADtN18hF7p9dx+k2K4RY0awCnt7wBcK:4ZuemAVOgJVADtDMdl2K4lOk
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01636_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.07 KB MD5: 07b7bad46ce79fb870b37d99db9496d8
SHA1: a50514e4f99e5d5c408f240d6f617b0fe035a611
SHA256: 7c267b7b66296b2021d9c3e225fb77e95db3a85934f9ce4d25c2d4edc13de8af
SSDeep: 48:jw8f1KgqNmpy38e20hCW+y06smBtHfUxGmWFIsmZjn3JMIkTcK:Ff1K5my20hYn6VxUxGmpnZMIkF
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01634_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.65 KB MD5: 11f88a2aa1bd4408b0fbc7ee4fa68aeb
SHA1: b04adf6c662942eadad647f4b8762444bbc493b1
SHA256: d8096b7bf89a3c95d8c26dd60c278dadd8f162d33d60a27c11391e9b371b35f5
SSDeep: 48:vd6bjE0/fJGtDLzHRMsO7Qu02cSRfoF3KQBFbDFlderaADsT+83vdtufmw8//UhN:U5GtDLtMq0RfEKA98Ry+YvdtM7x6MMxG
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01637_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.09 KB MD5: 630520e640bc5f84b0294c5358f67a36
SHA1: 054968d16a514157accbf460c899abfc3b816fac
SHA256: 88ec2c3e606b0e1061cf08b02cc3a4b406d690866867b4623704bb41e50c38c5
SSDeep: 96:Nt6bAhzk4MFuhEvPuBI5MfgCsNX3PELVSnIA8:NQbL4MFuZDYCwX3cLwnIA8
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01635_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.89 KB MD5: 7477c1dc389856077e91d04b667b9b54
SHA1: 13a5a7a3567a80b0ad6040471992f2aec2876a9d
SHA256: 7b6b186ac859c2ce2b3e8dc74192e54a8c470e28b002e8c43e7b223dc178bd58
SSDeep: 384:+W+oQ616G3fhSdLLHAdMyHyhnGHTAKOE1WrVilD:3+G5fhStHOYO1WAlD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\amd64\jvm.cfg.id-b4197730.[lockhelp@qq.com].gate 0.85 KB MD5: e689835e906b89e7c48878c3d57e1000
SHA1: e155617a361aedc97010acd4a0da4bc4299e2ee8
SHA256: 8f7e333b58d6a5c09df3ca98be83f204debf8922eb6a806be24f93c922b6fcc3
SSDeep: 24:QLycMeSjRx3Z7ilPpRma8yma30bqvMnq2PfBP:YaF+lPKa8O30bqUq2hP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01638_.wmf.id-b4197730.[lockhelp@qq.com].gate 10.53 KB MD5: d0d0a2f8ff17cd46cb28b4ba61c056c4
SHA1: 9034a5851b36ac30e95ba11f16c46bd47fa23cbe
SHA256: 7deeded21665df54476f7295c4cca38c135ccaea311c755d4dd6aee8637a6e90
SSDeep: 192:zrS+KYl4hRvqX8lFBC7ojiePch8xS5y5VlwS811QimgJQm22fzOfrtw8UwCI/:/S+PlyseEhRQpXiQi9JB22fzS5w8UVI/
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\copyright.id-b4197730.[lockhelp@qq.com].gate 3.40 KB MD5: e5f35a9d02887248135fb6a64c04f2cf
SHA1: 27b83be48d9cb212ec08d6a21672baee0f27b06c
SHA256: 576d18fba765c196a00ac94d7829ebc2b630413d98eb7cf1a4673088659115d9
SSDeep: 96:hSBy5SE31mugQTvcfSscMSHIsgDBsvz6LLq2hj:hYCSE3HkfSscMxXy2q2hj
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\bs01639_.wmf.id-b4197730.[lockhelp@qq.com].gate 4.37 KB MD5: 1be80a0f24fa32ba6d603ed38dca417e
SHA1: 0eccc4fe2914b1ceef6090111aaba37065c5903f
SHA256: 09c45d3b961d1ef96142e0a21883e812f4c6d56e29c10c1213709149b144f280
SSDeep: 96:X9j0Eft5x7ViN3FFsdKnxSYUZvT9Ob9Cb7f2+LNH6pQZcqbNto:tptj7MYgSN9m9CHbH6vqxto
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\cg1606.wmf.id-b4197730.[lockhelp@qq.com].gate 3.71 KB MD5: 773135bce4163b951a5d276fd6ae5551
SHA1: d26a661af0850f6416fec04b5787f2fb203c0fe6
SHA256: d58c9e91622e34bd8896ea9236fd95c40a94bc34b5580cb3a97e235ae1c959b5
SSDeep: 96:EqMugOmIx4dsodzIAqz2JBe7LCUc1fmv3TZj1KfwbK9ABjNsV:EzZIwr3JBepkfOVGwG9A9NsV
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\classic2.wmf.id-b4197730.[lockhelp@qq.com].gate 2.45 KB MD5: 3e00e23a276562adbca5afd32c5db0ae
SHA1: c4b9d7876db83aa0be157ece1c742bf4df24398e
SHA256: a7cb0028c95930cecf6ce282cfb85fe0be6720845bb3c35285c82afd6df8acb4
SSDeep: 48:heNutZJji/QldrjEbg2AMxtCZjGY0E1b3+9Vc3b4HT0i2cdQHtl7ukcK:hQmRAk0r8Z31b3Cc38H4iBmHN
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\calendars.properties.id-b4197730.[lockhelp@qq.com].gate 1.61 KB MD5: 15311dbc328442a8e64543a60be4c9d5
SHA1: e365467f55c56d3644815ec75ccd0aa70bf7ff65
SHA256: 44c83c433bebd6083a26a3b427e0a1e9903b639984873e9d1bd37e27d6364395
SSDeep: 24:6eF+/Fvh5L08HJp/drVDJI6bmb0NlJWUDfUQkDRUaFQIgy2DJ+nq2PfBd:6S+/B5/drDc0lWIGDGzxhD4q2hd
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\crane.wmf.id-b4197730.[lockhelp@qq.com].gate 5.38 KB MD5: b1ba1a89172601fdaf0c6c5d1376fb9c
SHA1: e96186a7fb9f3fab42f446bd645ef7af3cd0f688
SHA256: 3a6d59a2592d47676fdde6149abb284ad76cb5ebe1159163a401d2752b74ba7f
SSDeep: 96:ncTpfsyNDxy107mob8qQrkjeqHR+LgJl1AaX40jZ7PsHW6xuDCmYYMC:2x/Vy14yrpLSbAaI0jIg
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\classic1.wmf.id-b4197730.[lockhelp@qq.com].gate 2.61 KB MD5: 020f89bc828961c96400b56415b8867f
SHA1: 212aa2973367289ffbdc2b919f7dda399ac1b4a0
SHA256: 3fb9f1f14855f598075e40ae7bebb182c4286edd8e2b787ad05edea4a27930c1
SSDeep: 48:cacJgr4/uUVpKtPqMNXAFpC8byL47Id41jQDRC4xlXw/TJWOtHXAjxj9ICKvXQVy:Qu8pKteFU8bNmEW7XWJRWx0/OuG0
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\accessibility.properties.id-b4197730.[lockhelp@qq.com].gate 0.41 KB MD5: ca41280e6d2c26380b122b4f70be2435
SHA1: 90d9cc989b1c9db92a9d73d98d514e856eb08e34
SHA256: 582d8dfc02501b1c9f50fc0900a3b2cc2ace43e261e42bf97e9b6b3b32748c05
SSDeep: 12:AVTN7/2bbYFopix/zlWl74huaXqnN40fPx3gqB1WK/:Adl2pix/JWZaanq2PfBF
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\cup.wmf.id-b4197730.[lockhelp@qq.com].gate 3.13 KB MD5: 769a22fb307ea10a9e5711a86379b1be
SHA1: b7089a2d65c9e63db34f401ffd126b508a4270ce
SHA256: 9b98d76341fb27c78b8e68e74bf003bbabefec1fd3d2d2b1bbbe780e9d5eb5cf
SSDeep: 48:ra6EPpXJQv3m3+bmsvc1KqTZdY0x0XgDwb6sVeNqIeVaDyCm1/VLaUMYWcc:r98iK4mscQSZxGXgA6WeqIeVmyTVMYQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\cmm\gray.pf.id-b4197730.[lockhelp@qq.com].gate 0.85 KB MD5: f346cdac823987691fff7a179f2f176f
SHA1: 767b51b12942b3dc668969cf1ab1db0b7c79fccc
SHA256: 8b61d4b2d920594d8e2f4a3941bdd7a9bccf05c7394ea7ee712035a7fe95fdab
SSDeep: 24:lwxQodzR1DcPIcaiSXQnzYDwjUk7ub/nq2PfBP:SxIgcwXyU0j57ub/q2hP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\craninst.wmf.id-b4197730.[lockhelp@qq.com].gate 48.62 KB MD5: e6cee41ad8c73d18f7bfe053fc03c7e5
SHA1: 1c40918928b604050764a7aab99beff293305dab
SHA256: 981b7e06c48a5f533634f60d22ae6b60997d35e4d2f687cbcf6a01255c815cf2
SSDeep: 1536:K39aoKNXR6kIa3o1PY2q7DF3Wm+4NxHOJn/u3mz:OeXq1PYDF3Wmp5OJG3mz
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\classlist.id-b4197730.[lockhelp@qq.com].gate 82.62 KB MD5: 783e0567821da36d275aa460b8ae5e88
SHA1: 2170d44f1e0ef93467c9dcffbe307c81fc30dd36
SHA256: 8ad610b20961fc2219d4cdfb6d598824c2477dd269a315217701bf7ea67caf29
SSDeep: 1536:jSXuZ/U6wraAdE9JyrQrUCPR2ERwlmd8xYkpYvhI66bGIjPxD5Fn6:jSs/UBGC6AGzDRiWkpll5jpC
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00117_.wmf.id-b4197730.[lockhelp@qq.com].gate 30.64 KB MD5: c7eead5751adc2bbcbf617ad03f7e9d5
SHA1: 6e8b219bf3d9a4f01e0b66c8083ba7d7f27a74e0
SHA256: fe3df2f404161421990daa90f4525e6e4542a9c29d37b8c76ce1ddf8c2a27136
SSDeep: 768:CTr7wr8EnWa5utVaTxzdRPndkZ3YbgQIAfl4G5qBQtATuQ8eXG:Yr75tV+BdRPdh2A4+wN9lG
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\clip.wmf.id-b4197730.[lockhelp@qq.com].gate 2.44 KB MD5: 8b43ae926b857da4399cc7f0e50d4641
SHA1: 2bbd62e356f645743efb585595e03ae6e9243acb
SHA256: 2670f566a3ff100948053fadc92e68dc0d1219a64fc7195f1916c896e86448fd
SSDeep: 48:ZA2emF3JSBYRZ/bVIsERKHP1UvwvX6lmOdK9SaRcXId6i/9FrOT1cy:WS3I6z/bVIsERKtUvsXZOdirRc4TxOL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\cupinst.wmf.id-b4197730.[lockhelp@qq.com].gate 10.32 KB MD5: 10d2e39fc54af6d739db42ebe60af9bd
SHA1: 8322cceb396bb51e2c2ee870a7c3187800432b95
SHA256: a98693d2f8ed6f90b51002e33efb1ebd5ac34906e4ac14d739dcee5e48111447
SSDeep: 192:1w7GvO8ALtb9Ywd+jTls9QO5t7HTos3m4tVi75zr+r6rE92SgvS435t5tljym:1w72O8g/dcmf7HToYmTzyr6g9FgvzpJF
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00234_.wmf.id-b4197730.[lockhelp@qq.com].gate 29.17 KB MD5: a2dd60be19fa9e780cf4c4ca9b224aae
SHA1: 780e2656c3df48777f5249805a587efdb1b32af7
SHA256: 9844e3a83bca8d9e3e9c245e6f60522852c59076ff11b71fe72dd75c169d91c2
SSDeep: 768:DmcT+G8iRgeFdGj/4AdKaKWaKR6THrLdi9aiZZBuxNPo:Dm7tii6dIvuvTlAfBAJo
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00121_.wmf.id-b4197730.[lockhelp@qq.com].gate 8.31 KB MD5: 23717c17f1a291d4fed44d552899069e
SHA1: b520b988015695ceb2621be59436f3d1e7c646be
SHA256: 56d6578619bcefe495a0e84c2bf367594656613c672e8d1123394c4780cd0976
SSDeep: 192:FAZ6sbdDZeADfQvkmpOwntrNhAVB3p2Zrn:FunxIwfQv3trNhcdper
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00256_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.01 KB MD5: b901f88b24e203d92e4cbff456644dac
SHA1: 7912bc810bf0d7a464425661217320fc553b4a75
SHA256: 8f341575a363876b873fa958aee81d07d9d0fbee562eaca61664750b2dd72541
SSDeep: 48:EuC3v/UVpBy07cWyQ7bUnNcRr+Os6CccYj/mLkh7MpED95lRFGtuiGrNanIAcK:ETv8ly0YWyQ742Rrwp9YCc7ZB5dGPXIA
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00261_.wmf.id-b4197730.[lockhelp@qq.com].gate 37.32 KB MD5: 7cb7ef6bbef5810e5373a5f7cd8ccc3a
SHA1: 9e2608e01395bf46549c46eef5c21d8b350422d2
SHA256: cbb7628561c7fbf48df76bf1a29702b5b3cfc6d3e1f9161f55d07b8d8656a2fe
SSDeep: 768:qbyX5Mf9uwPC6ttBO+n/4jCS/Rb5oV7CbUs1NEbvCiEfuh+fol4rpW4Pjge:Fqf9uwzvv/wN/RyVBykvrgpm4dW40e
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00255_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.87 KB MD5: 4890e081627b04883fbb2d3e88639738
SHA1: 07018fe7caa507f53dbca251cb14861db061af6c
SHA256: fc3838a7961dcbdb33eee56a88ed62fa178de22f2eb378516f17e719f9527a44
SSDeep: 48:fHbHBb/Sw3rEliO343+LD9Erw6/zB/LQLqqs2Iv6ykyvtnaksbk3RY0DLLcK:DN54ZdAV/zBLQ+qsxkyVwbmzt
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00297_.wmf.id-b4197730.[lockhelp@qq.com].gate 39.32 KB MD5: e050cd1de7068df129fa939435fea254
SHA1: 5712e6bdafdd3d2e245e3f9b0b4e8858ba519b4c
SHA256: 3f0324f885aaee3bbac906e8f68a5d558d3eef32d426fe23010bda8ef6957644
SSDeep: 768:uHkufjBQkLeEPG/lPFhP8VDIzyQoxX5HfMDtfY6nSXiaF/ay84DmA+:uEYSKPG/VD8DImHxXVkDtfY6S5fJDmA+
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00372_.wmf.id-b4197730.[lockhelp@qq.com].gate 1.01 KB MD5: 221556c8b16d3a3cdeb26934c83f8ce0
SHA1: 8c6e7683f890d876ff409f3ccc3846ed41c53db1
SHA256: c07c1b1f9b8d6aa4d9ab60e49ece4683987e449af1ab3e56d333a5c17bdacbe5
SSDeep: 24:ptdMdXOyTU0sDptKbWWBN7qNJm/tKM1bSlsii4fczY5:KdoDptKbTB5q+tKM1bXircK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\cmm\pycc.pf.id-b4197730.[lockhelp@qq.com].gate 268.27 KB MD5: e8eca8fb32338f73ef7c64506f6f4526
SHA1: 08904088a1305f062feacbe434e5e458686cd16f
SHA256: 542011da2d6b7d184cffc5227978b3ade4780923dbe62e2cf7c5d3364badf9cf
SSDeep: 6144:MFraMAPuuBHr+BlQPJGpPv2eX8POKtgHwiA:MNwF+lQMpH1X8PO8NiA
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00405_.wmf.id-b4197730.[lockhelp@qq.com].gate 17.42 KB MD5: 94724dca0497e66d21b1adbfdf9285fe
SHA1: 477f94172f43b1f23166d9ad59b583d7f4089881
SHA256: fb783b1cbdb6bf9e2d9f2b46bda697d4cc7548b33a8a53d7d508266956cbcef9
SSDeep: 384:zGJOBpJDULpRAiSYpdcjAgtEfZz4KccOrV6Um5RlGWc2T:zGJQnyAKmjbe3Qc+k
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\cmm\linear_rgb.pf.id-b4197730.[lockhelp@qq.com].gate 1.26 KB MD5: d626847a48a37118540c53305937302a
SHA1: 852f8e58447da66a04cbf64cef5afb8737121003
SHA256: 08c5404ef688bc333edb84721131dcc2ba4bd7bf21e973ab34639ef25a400cea
SSDeep: 24:fafTYbzTvvenyqKRTjXL6nFS1X8jaGhfdrMCjFNY0nq2PfBL:SCtTDL6458jaGFfjLY0q2hL
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00419_.wmf.id-b4197730.[lockhelp@qq.com].gate 0.93 KB MD5: 715419349b5bb44f2f906ede3e116da4
SHA1: b041991290ad4dcd9ce4c791607ec3199f47e74f
SHA256: 8c1ca4a1244a0cf7b611b285f87e633f4876996c76298bc4eb374016daf0d541
SSDeep: 24:fQ7F8qe0vp7FXm39QSqIv2xMHFPJkhfczY5:WdFXAQA2xSUcK
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\cmm\srgb.pf.id-b4197730.[lockhelp@qq.com].gate 3.30 KB MD5: 7f69bc7d73aef1cd141d2003e623ce81
SHA1: c2ad06d45f30de861d02c534887f4994e285efe0
SHA256: 99b8d5cbad387a4a400fe26a01e6d1431fbf5d627067aac8ae2f1286b4c46cee
SSDeep: 96:X+JI2NY6uI+TMVaBIPAcJTyZt7aLkq2hP:O8QVaBIhJTy/okq2hP
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00407_.wmf.id-b4197730.[lockhelp@qq.com].gate 7.89 KB MD5: a9464a7c23bb341fb1e735c058e449f9
SHA1: 186e6be32104ea10d17fe40e1595715f6b8654bd
SHA256: 945714337060b6933bb8bf792fd84a38083e74da105ab2d1cc544cb85fe14fd9
SSDeep: 192:6ziK9BJfnUbrUy5Ocq4ZjdRVF1YJd4C9Y:KjPPcAy5O/4ZzCJdy
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\currency.data.id-b4197730.[lockhelp@qq.com].gate 4.26 KB MD5: 0286d194b0948a995f63e09e07f871e9
SHA1: efa27f1cb4e2f42c518b19b3059889c9d7d6340c
SHA256: 6dee3348bdf48068f19fc3b79c265f19ba726dd0338deffe5954dac526030354
SSDeep: 96:rqcjt7cUaFndwKQcQWTL6dTCnBljWMp0ac7HmPBqYKTHjBj+Ce8Je0pz9iOTaKUJ:fGUaz1QcQW91p0l2BjKDjBKCe5mjaKUJ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\cmm\ciexyz.pf.id-b4197730.[lockhelp@qq.com].gate 50.27 KB MD5: 851ca69991e49511ff70d62f96f632ff
SHA1: e705343c3f0dfacad3bffa944caa5af8d426daf1
SHA256: 4d149e2ae7e06535e333ffc1b2bddba51700e045519f738e4dcb413b92d7b2eb
SSDeep: 1536:VSh9U8fh3vH5FBPYUQPjyqw9sT2MJlJQXcJjmTYEH:VSha8fTvUjPT2q3JjmTYU
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00414_.wmf.id-b4197730.[lockhelp@qq.com].gate 42.14 KB MD5: 2f620d62cd70318461f1a7c3f20c1bbe
SHA1: 663581dffea6c26896072be2158e780c252c56cb
SHA256: 60fa12bbc2f85d7e7be952ee8b02bce3b80b94cbd539a5301d54ae289e5f1c49
SSDeep: 768:SNeWgEbAYe8r12LxoOL8KrtDEvTS2QImkE5YaE8lh981fCb+1Xj9uKQR:SNeWlbve8p2LxP5EvFQXkEOaTDbSut
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00413_.wmf.id-b4197730.[lockhelp@qq.com].gate 42.23 KB MD5: 6ebe841d71e72ebfe8577434d8bbc82c
SHA1: 1cbfb5c2d6cc17b8b6bd8db3af90422610033c83
SHA256: 0e12b089272108bc037b056d4da89ad1d43600eea1f70e7dc66b11f3b8ee8e3e
SSDeep: 768:BYouT9C8Z2sinCbhlR4aUL+aMOfbzV5NQNTTSFi6+uUmfKim0upGNw9ccWVSw:uHTZgnCFn4aUcOfbzV54Mi6+uUKKimGR
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00448_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.12 KB MD5: bc244e74ff3ca64b4cef8b0eba97014f
SHA1: d2dfac77d0a97c782600033986e18c0b5f69ea02
SHA256: 3d8ace3ee2cdcb4bbb596e3986f89e03f83315768a2822131eebfe69542fb425
SSDeep: 48:TfqDdLrpX2DAfGxzRL3I44Bk8JSmOO3cu14tMrV7iey1kyJxa8OAYBLcK:DqBvpGDpVL4lBTD31bIxSH
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00437_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.12 KB MD5: 8449a4009b520479aedb28051a0359e3
SHA1: 4372c7b408d68608369c774e590413ba8185034f
SHA256: 8aecb68bb4ab8ddb347bd6f7c89b889d935b3e57e8dc836083dc7d7f3ed6663b
SSDeep: 48:+wUgPyqfHcvrHNw858dLGDAJ1ytXvLdd7cK:+tgPXkvrQLfEXvxd9
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00449_.wmf.id-b4197730.[lockhelp@qq.com].gate 10.00 KB MD5: 0cbae748c6633c40fc1c9bf99ccd3eb6
SHA1: 94bae685dde57100798bebe0ca83a994d47dc41d
SHA256: 2d9f41cd7845489352883f42a22915660681f53429af7928985b17551aae2efb
SSDeep: 192:SwOugKzA+L/RFQSSj141K7doQZQ6VLC7a1yvZB7zPAsV4ttILfpgpIZkMkq:SdugKz1zRFQ1FBRNe7a1yvZZAO+sCSkY
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\content-types.properties.id-b4197730.[lockhelp@qq.com].gate 5.68 KB MD5: 10b27510871c079116436a3f5aa4e080
SHA1: be08f88f37b1df51eab977e4a487dda254997954
SHA256: 36bd94ed30d41fd837d06fa07ce5238552a3d0e3c3f877cbd3d51a5e2612114f
SSDeep: 96:+9qKRkyhsjA6VE0bcA+NdKAkk/OtfQ/bqHaykcfyGhBJZChtD7Dm1U97q2hF:8qKRpWJ1bwKC/OtfQTqH+WyIBsaiFq23
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00687_.wmf.id-b4197730.[lockhelp@qq.com].gate 20.54 KB MD5: d555920968c989d29154d6ad245c922c
SHA1: 8da17267ae085cb4f5d5e0b33695dd02e9237e8c
SHA256: 1493e97ac6da6d7864890aa5c97356a9500bab09cd9518e203fcb913bdd01ed5
SSDeep: 384:IlSI5N1tzOPZf1woTS5ldW0+RrcNf83yHMVoqnZJWWKPVe6nIzuv/:IlzyPZfiW0+JAZgPnZoPzPv/
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd00705_.wmf.id-b4197730.[lockhelp@qq.com].gate 24.25 KB MD5: 347ff891b0d19c425d8eb95e9b5a2e05
SHA1: b63910636ff2d584309ea31dd40ef2d68e48723b
SHA256: 4e801b76319b66815f36242a897d2ab03b08479e5b5d0e3f0f0273afb6729c9a
SSDeep: 768:5wIZV2f3oAaVawAxwvuyPDJvTz8P4id/9X8:WIZVw3baVaPQrpM8
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01015_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.42 KB MD5: 57fe48ec377eeee42a8dc9b77c7f6040
SHA1: 0bc60978c6971b7e8939513b6bb8c43c4c64e5c6
SHA256: d7d65ab1eca31825a94b56cc3a881329a073d4cc63b95f674ea6ffe3a4f2b2bc
SSDeep: 48:rtpJfEbqXj1GQ4qyFrt5kZQopu3ELZu6odBvvWCH72UdwMh+cK:r1f1OfYQZ0Zu6sBvvG81h2
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01039_.wmf.id-b4197730.[lockhelp@qq.com].gate 14.71 KB MD5: bb602e8093c8fc988ea6385ab9426288
SHA1: 728314e19d80df56d4bb9366c1d6c3003cad1154
SHA256: 184e490acd92a9ce83e4143ce12b9e18cfcfe00b00e5057753eec739ff93f9b6
SSDeep: 384:BiL9Rf4no9Km0LiJXSjDA+6jubjN60O0ud:QvfILWSjcT63rO7
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_de.properties.id-b4197730.[lockhelp@qq.com].gate 3.48 KB MD5: 457e574cfdb5f339f0b9dfb8e419bcf9
SHA1: 1c763a0c5dc56382b26cce1a78fc147aebe187be
SHA256: 4f3cf075256f34b55bd034fbe65361cf4b122c00daef3ad5e9664348956c5b4f
SSDeep: 96:vHh+/eA85zk6+0F47fX4zV4+hgfWFAWQxSdIWpSX0klbxnmcEq2hx:v4GA85zTY7f41RLQwVyHbxmxq2hx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages.properties.id-b4197730.[lockhelp@qq.com].gate 3.04 KB MD5: 2e5631391d526182ab23f677c843d435
SHA1: 646820f1876112230b481889d837d22c918b5dcf
SHA256: 3b4bc61bd73b98f1a82cfaee2ab40b6b8487bbe46c3b7681255c2324b60688e6
SSDeep: 96:EpdxBTK/Q4b+uq9hY8nuJwCu3aBWH2K/1+V4we7q2hH:GxBaQ4y9wCumXW++V4we7q2hH
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01143_.wmf.id-b4197730.[lockhelp@qq.com].gate 2.32 KB MD5: ef15a46dc11f991a8a074d92d16198d8
SHA1: 7d3bab7cbc743dd4eceb3451c754cb8365e09117
SHA256: 18adc1286f76b1fe162e9b70c4392435f8eed3d9aee3146ddb0be76d73a35afa
SSDeep: 48:4Vw0KOq9V0MIUaLFuMb8oGxeU91wKqnmFdD1n9I22dKw+gWciygkFr8JecK:4Vrvq9RkgS5GYUQnsdLI22dx+UiyHWW
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01140_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.78 KB MD5: 2b33ca870ccaae1afe5d8f3cde5461dd
SHA1: 84c7aaa1bdc88c0045f0bce737058dafd5ad314b
SHA256: e83510b6cdf1b2c665554b91d2683c878f2c2afdabdc65b4d2de5479b11fcbcd
SSDeep: 96:4odDbuSSZKNnYepUdgo+27PwhMCsTf33aAvMJjUR:4odfuSkPeG1PwhbsT/akiUR
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01139_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.79 KB MD5: 9a3d92878b5fe75e0bc949ba2becb8be
SHA1: 5e595c8960fd6fc7ef3e2051c7f9625d6e0193b2
SHA256: 877b1adbd9c713c8fef1656b46378caf988e12b44f209cd63a93dd155b829ab4
SSDeep: 96:dbd4G3S910WtjG2qmfOs5El2kTuCrD5ELw4mx:dbmGizlEmb+l55ELix
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_es.properties.id-b4197730.[lockhelp@qq.com].gate 3.78 KB MD5: 010701c1fe7ef0a871175fd7adbeac4e
SHA1: 3da719e214a63bf5eeae498864f79724a6781204
SHA256: 6062c1956ae4fa8fb2fa2b3f535ccfa710b95015d15d7e4ff66e10900da56d0a
SSDeep: 96:Y+WDMy7QfSDuWSys9+q6e09XytWmCfQhmsq2hx:Y3oYvDt9sULA/mCFq2hx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01138_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.84 KB MD5: 93b1122e5d98571dffa2887675a8e9a8
SHA1: ebd46e9031ebb81bd74575c571976cc4abd13792
SHA256: 39c8dfbfb7e51df5419aee6662e8ae11f8fb9190207b4e2c88f26e721600759b
SSDeep: 48:68xNL1OjrZAmzef0F7WWmFYufKSKtHxy9sNJ1qPxiMkuc0U4irNopbfsUkMQAAmL:6OWemzQ0BWWt2KtHg1Quc0U7N0OCAmkm
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_it.properties.id-b4197730.[lockhelp@qq.com].gate 3.41 KB MD5: dd8afb9ee9fc1aa8e81d94e9f2f80b84
SHA1: 7556593c8ef5a163d960309c2a3cc14577bdef8f
SHA256: f6a690115ceabc2ff250144969caf2a8753e5cece62c07b7fad5e095c0dfad47
SSDeep: 96:JjG1LxfvdwZh6aIXVR1z3I47G8/JO9ahy6GHq2hx:JjyVfvaXFIFR1z4+GGOFBq2hx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_fr.properties.id-b4197730.[lockhelp@qq.com].gate 3.59 KB MD5: 53af0cbc1b8ba9e90c70344ab8491830
SHA1: ff61bb8ad3f8fb8e66b4824da19954337a62a390
SHA256: ed26772f4c702959ebecb99bb289969c063a94977539db79824a14a8b95fce7f
SSDeep: 96:BWzbHUe+J3mfBvi1CILVYPUe6vzeXf4gFb8r8atq2hx:gXUe+NaBa1CIJ9revtB84Wq2hx
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\microsoft office\root\clipart\pub60cor\dd01151_.wmf.id-b4197730.[lockhelp@qq.com].gate 3.14 KB MD5: f264fd7be16afd9b11eb6165fb02b97b
SHA1: e82cc9d42b59136ad3d2160e4fc6b79ca4eb447b
SHA256: d7fd3133386206cc0d23816cc2771c30e248cfdc3679618601e074ed6ba2db78
SSDeep: 48:rucnri+CTzlmJqH94Wky85PYiTj8ytAL9RpPcmig1gfqGoglxzaDiVL7yfwcK:YJmJqd4i8Ci8ZjPb1gfVDrOGyQ
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_pt_br.properties.id-b4197730.[lockhelp@qq.com].gate 3.47 KB MD5: fce73295b4345dc64c27675e2d45b233
SHA1: 36cacb1b4e3b16615652a2a4159bfab88001357f
SHA256: 7fdad9ae523b216838a3030f32eb5ed99982932cad23a592f85817c0b0b147ab
SSDeep: 96:HtuOK+Dbu0s/HA+Pq9CzG/m0sBZUuWDV/1aIkq2hD:HdK+DbBs/g+OCzG+0huQV/1Dkq2hD
False
c:\users\fd1hvy\appdata\local\virtualstore\program files\java\jre1.8.0_144\lib\deploy\messages_ko.properties.id-b4197730.[lockhelp@qq.com].gate 5.84 KB MD5: e00fe6985afbbd3f7dca498ead0f20ad
SHA1: bf5640774ad01db04a626bb93ad7626e0a1e2119
SHA256: 83d405a071ba1e6e409acb011e3e7e71d403f01b558300c809f695ed2185024e
SSDeep: 96:fatqbv4Y+ak53Eh9Qbm3zkn3G/348tM/3khpGQfhFfDl4cV+OWWlqPKupIq2hx:Gqbv4YO53qQbNW/oWMvkh4iZHlqPJSqu
False
Host Behavior
File (4885)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\System32\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\WINDOWS\System32\1csrss.exe desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\FD1HVy\AppData\Roaming\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Windows\System32\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE False 1
Fn
Create C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE False 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$WINRE_BACKUP_PARTITION.MARKER desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\el-GR\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\es-ES\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\es-ES\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\et-EE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\et-EE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\malgun_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\meiryon_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\meiryon_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msjhn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msjhn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msjh_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msjh_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msyhn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msyhn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\msyh_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\msyh_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\Fonts\segmono_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\segmono_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\malgun_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\hiberfil.sys desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-International%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-International%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Known Folders API Service.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Known Folders API Service.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Store%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Store%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Security.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Security.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Setup.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Setup.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Setup.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\System.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Windows PowerShell.evtx desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\System.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\System.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Logs\Windows PowerShell.evtx desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\Windows PowerShell.evtx.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\pagefile.sys desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\mip.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\mraut.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\mip.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\COPYRIGHT.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\classlist desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\classlist desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\classlist.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Write C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml size = 1048560 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml size = 4128 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml size = 368 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 527968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate size = 9840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate size = 384 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 9040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 6688 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 8112 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 14880 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7696 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 512 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 12704 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3488 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 12496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 2608 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 10608 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 15312 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5328 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 4960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 1152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 6992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7584 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate size = 16000 True 1
Fn
Data
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 13264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 8592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 9264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 4400 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3136 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3392 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5696 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4736 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10848 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 20592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14432 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7088 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3760 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui size = 2768 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF size = 27872 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7552 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2112 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6064 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2352 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3424 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7680 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4624 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui size = 6640 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll size = 4304 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4816 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4880 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 28960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 22528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11648 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16192 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16688 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4928 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26752 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16128 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 24336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 40208 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 48000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 24784 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 47792 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 20560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14544 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 13520 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 20192 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 20464 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9712 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8784 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 15744 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 18320 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11072 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9824 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7872 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10160 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1520 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1472 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1712 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1552 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14448 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF size = 9312 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4720 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1744 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5760 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2656 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5280 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3792 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4176 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 816 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 27056 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 13104 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11504 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 19488 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3776 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 29008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1344 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4416 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 27568 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1056 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2384 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1456 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2176 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8368 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1728 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12800 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3120 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1216 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2064 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5584 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1680 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3536 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2736 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3904 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7184 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2448 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1888 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3504 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3952 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate size = 15008 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate size = 640 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10544 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\COPYRIGHT.id-B4197730.[lockhelp@qq.com].gate size = 3248 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\COPYRIGHT.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties.id-B4197730.[lockhelp@qq.com].gate size = 1392 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3568 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5280 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2432 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF size = 160 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF size = 260 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2976 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 49552 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\classlist.id-B4197730.[lockhelp@qq.com].gate size = 84368 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\classlist.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 31136 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate size = 640 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf.id-B4197730.[lockhelp@qq.com].gate size = 1056 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 29632 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2848 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 37984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2704 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 40032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 800 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf.id-B4197730.[lockhelp@qq.com].gate size = 274480 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 720 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf.id-B4197730.[lockhelp@qq.com].gate size = 3152 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\currency.data.id-B4197730.[lockhelp@qq.com].gate size = 4128 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\currency.data.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 51248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 42912 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 43008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1936 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties.id-B4197730.[lockhelp@qq.com].gate size = 5552 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties.id-B4197730.[lockhelp@qq.com].gate size = 260 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 20800 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties.id-B4197730.[lockhelp@qq.com].gate size = 2864 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties.id-B4197730.[lockhelp@qq.com].gate size = 250 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 24592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14832 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate size = 3312 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2144 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3632 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3648 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate size = 3616 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3696 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties.id-B4197730.[lockhelp@qq.com].gate size = 3232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties.id-B4197730.[lockhelp@qq.com].gate size = 3424 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2976 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties.id-B4197730.[lockhelp@qq.com].gate size = 3296 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties.id-B4197730.[lockhelp@qq.com].gate size = 5728 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2800 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties.id-B4197730.[lockhelp@qq.com].gate size = 3424 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties size = 2976 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties.id-B4197730.[lockhelp@qq.com].gate size = 4080 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2784 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties.id-B4197730.[lockhelp@qq.com].gate size = 6352 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties.id-B4197730.[lockhelp@qq.com].gate size = 3760 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties.id-B4197730.[lockhelp@qq.com].gate size = 3760 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2096 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2096 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar.id-B4197730.[lockhelp@qq.com].gate size = 188032 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar.id-B4197730.[lockhelp@qq.com].gate size = 8288 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2016 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index.id-B4197730.[lockhelp@qq.com].gate size = 1472 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar.id-B4197730.[lockhelp@qq.com].gate size = 42192 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2416 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2064 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar.id-B4197730.[lockhelp@qq.com].gate size = 280176 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar.id-B4197730.[lockhelp@qq.com].gate size = 250 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar.id-B4197730.[lockhelp@qq.com].gate size = 32704 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1904 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar.id-B4197730.[lockhelp@qq.com].gate size = 44528 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar.id-B4197730.[lockhelp@qq.com].gate size = 251328 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1456 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties.id-B4197730.[lockhelp@qq.com].gate size = 3936 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc.id-B4197730.[lockhelp@qq.com].gate size = 3776 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc.id-B4197730.[lockhelp@qq.com].gate size = 240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2096 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar.id-B4197730.[lockhelp@qq.com].gate size = 68928 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 75152 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 260 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf.id-B4197730.[lockhelp@qq.com].gate size = 75136 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf.id-B4197730.[lockhelp@qq.com].gate size = 264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1776 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 912 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src.id-B4197730.[lockhelp@qq.com].gate size = 10576 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf.id-B4197730.[lockhelp@qq.com].gate size = 80864 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8576 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 344912 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 258 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 19072 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4160 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 698240 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 254 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1392 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 317904 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 234080 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[lockhelp@qq.com].gate size = 260 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 13056 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2704 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[lockhelp@qq.com].gate size = 13968 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 242704 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[lockhelp@qq.com].gate size = 266 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[lockhelp@qq.com].gate size = 64 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[lockhelp@qq.com].gate size = 246 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6784 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12368 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 13952 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6944 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2288 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17312 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17856 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[lockhelp@qq.com].gate size = 944176 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7952 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 752 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1296 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 30256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[lockhelp@qq.com].gate size = 20112 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[lockhelp@qq.com].gate size = 20080 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14208 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 29216 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[lockhelp@qq.com].gate size = 116448 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 37392 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 15872 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[lockhelp@qq.com].gate size = 560592 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[lockhelp@qq.com].gate size = 33936 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 18208 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[lockhelp@qq.com].gate size = 584592 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 46816 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[lockhelp@qq.com].gate size = 2464 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[lockhelp@qq.com].gate size = 248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8432 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7888 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16400 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2112 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10832 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4800 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[lockhelp@qq.com].gate size = 2864 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[lockhelp@qq.com].gate size = 4000 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[lockhelp@qq.com].gate size = 14640 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[lockhelp@qq.com].gate size = 254 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[lockhelp@qq.com].gate size = 384 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[lockhelp@qq.com].gate size = 3392 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[lockhelp@qq.com].gate size = 246 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[lockhelp@qq.com].gate size = 266 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5104 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[lockhelp@qq.com].gate size = 4480 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[lockhelp@qq.com].gate size = 240 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[lockhelp@qq.com].gate size = 2128 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[lockhelp@qq.com].gate size = 2800 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17408 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[lockhelp@qq.com].gate size = 10400 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8928 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1488 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[lockhelp@qq.com].gate size = 4064 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa.id-B4197730.[lockhelp@qq.com].gate size = 786690 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[lockhelp@qq.com].gate size = 114928 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[lockhelp@qq.com].gate size = 112 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[lockhelp@qq.com].gate size = 36528 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 768 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[lockhelp@qq.com].gate size = 2480 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[lockhelp@qq.com].gate size = 246 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 912 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11168 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[lockhelp@qq.com].gate size = 3040 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[lockhelp@qq.com].gate size = 48 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[lockhelp@qq.com].gate size = 3536 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[lockhelp@qq.com].gate size = 544 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[lockhelp@qq.com].gate size = 226 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 13984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 15168 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 42720 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[lockhelp@qq.com].gate size = 8416 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[lockhelp@qq.com].gate size = 1216 True 1
Fn
Data
Write C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 9328 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2416 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 7392 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1168 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6976 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6176 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 10576 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17936 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 30416 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 12992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[lockhelp@qq.com].gate size = 9328 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 4848 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 7568 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 31184 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10320 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 9808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 234 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 5856 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 7184 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 8576 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2192 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4400 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1568 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4672 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 5984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3712 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6656 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 5456 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3136 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6768 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[lockhelp@qq.com].gate size = 8544 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[lockhelp@qq.com].gate size = 5728 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[lockhelp@qq.com].gate size = 6080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5408 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id-B4197730.[lockhelp@qq.com].gate size = 228 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[lockhelp@qq.com].gate size = 6032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1664 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[lockhelp@qq.com].gate size = 7776 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[lockhelp@qq.com].gate size = 6576 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2480 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3296 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[lockhelp@qq.com].gate size = 6768 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2240 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 10128 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[lockhelp@qq.com].gate size = 5408 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3776 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3664 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1536 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[lockhelp@qq.com].gate size = 7360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SHOW_01.MID.id-B4197730.[lockhelp@qq.com].gate size = 6400 True 1
Fn
Data
For performance reasons, the remaining 3854 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (10)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = 83, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run value_name = 1csrss.exe, data = 7503592, size = 84, type = REG_SZ False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = 1csrss.exe, data = C:\Users\FD1HVy\AppData\Roaming\1csrss.exe, size = 84, type = REG_SZ True 1
Fn
Process (2967)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\cmd.exe os_pid = 0xe78, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\System32\1csrss.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\WINDOWS\system32\cmd.exe os_pid = 0xd74, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Enumerate Processes - - True 2896
Fn
Enumerate Processes - - False 68
Fn
Module (164)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x77740000 True 1
Fn
Load advapi32.dll base_address = 0x773f0000 True 1
Fn
Load user32.dll base_address = 0x76360000 True 1
Fn
Load Shell32.dll base_address = 0x75010000 True 1
Fn
Load ntdll.dll base_address = 0x77c70000 True 1
Fn
Load mpr.dll base_address = 0x74670000 True 1
Fn
Load ws2_32.dll base_address = 0x77940000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x77740000 True 30
Fn
Get Filename - process_name = c:\windows\system32\1csrss.exe, file_name_orig = C:\Windows\System32\1csrss.exe, size = 32767 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x777551b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x777550d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x777aee40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x777aed70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x7778e500 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x777aef40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x77755090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x777aef10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x77753cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x77754cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x777832c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x77783780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x777aeb70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x77756c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x77756c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x777aea10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x777aeca0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x77750d20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x777add50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x777aed40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x77756b10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x777aebb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x77756760 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77cbb250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x777af090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x777aed10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x777aebf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77cbb2d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x777aec80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x77756bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x77756bd0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c9fb90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x777aec20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x777aeab0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x777556c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x777546b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x77754a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x77755da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x77755dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x777aea20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x777af100 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x777af020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x777af180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x777af130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x777af0e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x777aedf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x777551f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77caf630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cb2dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x777557f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x77754590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x777aeae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x77754610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x77754430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x77754410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x77755cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x777567e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x777554e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x777567a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x77755010 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x7778edc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x7778f8f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x7778f750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x7740e580 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x7740e5a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x7740f530 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x7740ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x7740efb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x7740ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x77410540 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x7740fa20 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x7740fc00 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x774226d0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x77412380 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x77422f70 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x7740fc80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x7638f210 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75174730 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77ce2070 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74672640 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74672790 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74672410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x77945b40 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x77954510 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x77945030 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x77950c50 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x77945410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x77950910 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x77976cb0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x77959160 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x77958ff0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x77756b30 True 30
Fn
Service (204)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 8
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 8
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 20
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 20
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 5
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 5
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 2
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 8
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 20
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 5
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
System (1026)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = NQDPDE True 1
Fn
Sleep duration = -1 (infinite) True 3
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 68
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 253
Fn
Get Time type = Performance Ctr, time = 12618289270 True 1
Fn
Get Time type = Ticks, time = 126140 True 1
Fn
Get Time type = Ticks, time = 126156 True 2
Fn
Get Time type = Ticks, time = 129531 True 1
Fn
Get Time type = Ticks, time = 129625 True 1
Fn
Get Time type = Ticks, time = 130453 True 1
Fn
Get Time type = Ticks, time = 130593 True 3
Fn
Get Time type = Ticks, time = 130718 True 3
Fn
Get Time type = Ticks, time = 130906 True 2
Fn
Get Time type = Ticks, time = 131218 True 2
Fn
Get Time type = Ticks, time = 131390 True 2
Fn
Get Time type = Ticks, time = 131531 True 2
Fn
Get Time type = Ticks, time = 131640 True 3
Fn
Get Time type = Ticks, time = 131750 True 3
Fn
Get Time type = Ticks, time = 131859 True 2
Fn
Get Time type = Ticks, time = 131968 True 2
Fn
Get Time type = Ticks, time = 132078 True 2
Fn
Get Time type = Ticks, time = 132187 True 2
Fn
Get Time type = Ticks, time = 132296 True 2
Fn
Get Time type = Ticks, time = 132406 True 2
Fn
Get Time type = Ticks, time = 132515 True 2
Fn
Get Time type = Ticks, time = 132625 True 2
Fn
Get Time type = Ticks, time = 132765 True 4
Fn
Get Time type = Ticks, time = 133640 True 2
Fn
Get Time type = Ticks, time = 133843 True 4
Fn
Get Time type = Ticks, time = 134281 True 2
Fn
Get Time type = Ticks, time = 134500 True 2
Fn
Get Time type = Ticks, time = 134656 True 2
Fn
Get Time type = Ticks, time = 134781 True 2
Fn
Get Time type = Ticks, time = 134890 True 4
Fn
Get Time type = Ticks, time = 135000 True 2
Fn
Get Time type = Ticks, time = 135156 True 2
Fn
Get Time type = Ticks, time = 135515 True 2
Fn
Get Time type = Ticks, time = 135625 True 2
Fn
Get Time type = Ticks, time = 135750 True 2
Fn
Get Time type = Ticks, time = 135937 True 4
Fn
Get Time type = Ticks, time = 136062 True 2
Fn
Get Time type = Ticks, time = 136218 True 2
Fn
Get Time type = Ticks, time = 136328 True 2
Fn
Get Time type = Ticks, time = 136437 True 2
Fn
Get Time type = Ticks, time = 136968 True 4
Fn
Get Time type = Ticks, time = 137234 True 2
Fn
Get Time type = Ticks, time = 137375 True 2
Fn
Get Time type = Ticks, time = 137546 True 2
Fn
Get Time type = Ticks, time = 137890 True 2
Fn
Get Time type = Ticks, time = 138171 True 4
Fn
Get Time type = Ticks, time = 138406 True 2
Fn
Get Time type = Ticks, time = 138546 True 2
Fn
Get Time type = Ticks, time = 138687 True 2
Fn
Get Time type = Ticks, time = 138843 True 2
Fn
Get Time type = Ticks, time = 138953 True 2
Fn
Get Time type = Ticks, time = 139062 True 2
Fn
Get Time type = Ticks, time = 139171 True 2
Fn
Get Time type = Ticks, time = 139296 True 4
Fn
Get Time type = Ticks, time = 139671 True 2
Fn
Get Time type = Ticks, time = 139781 True 2
Fn
Get Time type = Ticks, time = 139921 True 2
Fn
Get Time type = Ticks, time = 140093 True 2
Fn
Get Time type = Ticks, time = 140187 True 2
Fn
Get Time type = Ticks, time = 140421 True 4
Fn
Get Time type = Ticks, time = 140531 True 2
Fn
Get Time type = Ticks, time = 140640 True 2
Fn
Get Time type = Ticks, time = 140750 True 2
Fn
Get Time type = Ticks, time = 140859 True 2
Fn
Get Time type = Ticks, time = 140968 True 2
Fn
Get Time type = Ticks, time = 141093 True 2
Fn
Get Time type = Ticks, time = 141546 True 4
Fn
Get Time type = Ticks, time = 141687 True 2
Fn
Get Time type = Ticks, time = 141828 True 2
Fn
Get Time type = Ticks, time = 141937 True 2
Fn
Get Time type = Ticks, time = 142046 True 2
Fn
Get Time type = Ticks, time = 142171 True 2
Fn
Get Time type = Ticks, time = 143078 True 4
Fn
Get Time type = Ticks, time = 143234 True 2
Fn
Get Time type = Ticks, time = 143359 True 2
Fn
Get Time type = Ticks, time = 143468 True 2
Fn
Get Time type = Ticks, time = 143593 True 2
Fn
Get Time type = Ticks, time = 143703 True 2
Fn
Get Time type = Ticks, time = 143812 True 2
Fn
Get Time type = Ticks, time = 143921 True 2
Fn
Get Time type = Ticks, time = 144031 True 2
Fn
Get Time type = Ticks, time = 144140 True 4
Fn
Get Time type = Ticks, time = 145187 True 4
Fn
Get Time type = Ticks, time = 145328 True 2
Fn
Get Time type = Ticks, time = 145437 True 2
Fn
Get Time type = Ticks, time = 145546 True 2
Fn
Get Time type = Ticks, time = 145671 True 2
Fn
Get Time type = Ticks, time = 145859 True 2
Fn
Get Time type = Ticks, time = 146406 True 4
Fn
Get Time type = Ticks, time = 146625 True 2
Fn
Get Time type = Ticks, time = 146765 True 2
Fn
Get Time type = Ticks, time = 146875 True 2
Fn
Get Time type = Ticks, time = 146984 True 2
Fn
Get Time type = Ticks, time = 147093 True 2
Fn
Get Time type = Ticks, time = 147250 True 2
Fn
Get Time type = Ticks, time = 147359 True 2
Fn
Get Time type = Ticks, time = 147468 True 4
Fn
Get Time type = Ticks, time = 147578 True 2
Fn
Get Time type = Ticks, time = 147687 True 2
Fn
Get Time type = Ticks, time = 147796 True 2
Fn
Get Time type = Ticks, time = 147921 True 2
Fn
Get Time type = Ticks, time = 148031 True 2
Fn
Get Time type = Ticks, time = 148140 True 2
Fn
Get Time type = Ticks, time = 148250 True 2
Fn
Get Time type = Ticks, time = 148359 True 2
Fn
Get Time type = Ticks, time = 148468 True 2
Fn
Get Time type = Ticks, time = 148578 True 4
Fn
Get Time type = Ticks, time = 148687 True 2
Fn
Get Time type = Ticks, time = 148796 True 2
Fn
Get Time type = Ticks, time = 148906 True 2
Fn
Get Time type = Ticks, time = 149015 True 2
Fn
Get Time type = Ticks, time = 149125 True 2
Fn
Get Time type = Ticks, time = 149328 True 2
Fn
Get Time type = Ticks, time = 149484 True 2
Fn
Get Time type = Ticks, time = 149593 True 4
Fn
Get Time type = Ticks, time = 149703 True 2
Fn
Get Time type = Ticks, time = 149812 True 2
Fn
Get Time type = Ticks, time = 149937 True 2
Fn
Get Time type = Ticks, time = 150046 True 2
Fn
Get Time type = Ticks, time = 150171 True 2
Fn
Get Time type = Ticks, time = 150296 True 2
Fn
Get Time type = Ticks, time = 150406 True 2
Fn
Get Time type = Ticks, time = 150546 True 2
Fn
Get Time type = Ticks, time = 150750 True 4
Fn
Get Time type = Ticks, time = 150937 True 2
Fn
Get Time type = Ticks, time = 151046 True 2
Fn
Get Time type = Ticks, time = 151156 True 2
Fn
Get Time type = Ticks, time = 151265 True 2
Fn
Get Time type = Ticks, time = 151375 True 2
Fn
Get Time type = Ticks, time = 151484 True 2
Fn
Get Time type = Ticks, time = 151781 True 4
Fn
Get Time type = Ticks, time = 151906 True 2
Fn
Get Time type = Ticks, time = 152015 True 2
Fn
Get Time type = Ticks, time = 152125 True 2
Fn
Get Time type = Ticks, time = 152234 True 2
Fn
Get Time type = Ticks, time = 152359 True 2
Fn
Get Time type = Ticks, time = 152515 True 2
Fn
Get Time type = Ticks, time = 152718 True 2
Fn
Get Time type = Ticks, time = 152828 True 4
Fn
Get Time type = Ticks, time = 152937 True 2
Fn
Get Time type = Ticks, time = 153140 True 2
Fn
Get Time type = Ticks, time = 153250 True 2
Fn
Get Time type = Ticks, time = 153453 True 2
Fn
Get Time type = Ticks, time = 153562 True 2
Fn
Get Time type = Ticks, time = 153671 True 2
Fn
Get Time type = Ticks, time = 153781 True 2
Fn
Get Time type = Ticks, time = 153890 True 4
Fn
Get Time type = Ticks, time = 154093 True 2
Fn
Get Time type = Ticks, time = 154484 True 2
Fn
Get Time type = Ticks, time = 154765 True 2
Fn
Get Time type = Ticks, time = 154875 True 2
Fn
Get Time type = Ticks, time = 155000 True 4
Fn
Get Time type = Ticks, time = 155109 True 2
Fn
Get Time type = Ticks, time = 155218 True 2
Fn
Get Time type = Ticks, time = 155343 True 2
Fn
Get Time type = Ticks, time = 155453 True 2
Fn
Get Time type = Ticks, time = 155562 True 2
Fn
Get Time type = Ticks, time = 155734 True 2
Fn
Get Time type = Ticks, time = 155890 True 2
Fn
Get Time type = Ticks, time = 156000 True 2
Fn
Get Time type = Ticks, time = 156109 True 4
Fn
Get Time type = Ticks, time = 156218 True 2
Fn
Get Time type = Ticks, time = 156328 True 2
Fn
Get Time type = Ticks, time = 156453 True 2
Fn
Get Time type = Ticks, time = 156578 True 2
Fn
Get Time type = Ticks, time = 156734 True 2
Fn
Get Time type = Ticks, time = 156843 True 2
Fn
Get Time type = Ticks, time = 157000 True 2
Fn
Get Time type = Ticks, time = 157125 True 4
Fn
Get Time type = Ticks, time = 157234 True 2
Fn
Get Time type = Ticks, time = 157343 True 2
Fn
Get Time type = Ticks, time = 157468 True 2
Fn
Get Time type = Ticks, time = 157578 True 2
Fn
Get Time type = Ticks, time = 157781 True 2
Fn
Get Time type = Ticks, time = 157906 True 2
Fn
Get Time type = Ticks, time = 158015 True 2
Fn
Get Time type = Ticks, time = 158156 True 4
Fn
Get Time type = Ticks, time = 158265 True 2
Fn
Get Time type = Ticks, time = 158406 True 2
Fn
Get Time type = Ticks, time = 158515 True 2
Fn
Get Time type = Ticks, time = 158625 True 2
Fn
Get Time type = Ticks, time = 158734 True 2
Fn
Get Time type = Ticks, time = 158906 True 2
Fn
Get Time type = Ticks, time = 159093 True 2
Fn
Get Time type = Ticks, time = 159281 True 4
Fn
Get Time type = Ticks, time = 159390 True 2
Fn
Get Time type = Ticks, time = 159500 True 2
Fn
Get Time type = Ticks, time = 159609 True 2
Fn
Get Time type = Ticks, time = 159718 True 2
Fn
Get Time type = Ticks, time = 159859 True 2
Fn
Get Time type = Ticks, time = 159984 True 2
Fn
Get Time type = Ticks, time = 160109 True 2
Fn
Get Time type = Ticks, time = 160250 True 2
Fn
Get Time type = Ticks, time = 160359 True 4
Fn
Get Time type = Ticks, time = 160484 True 2
Fn
Get Time type = Ticks, time = 160656 True 2
Fn
Get Time type = Ticks, time = 160781 True 2
Fn
Get Time type = Ticks, time = 160921 True 2
Fn
Get Time type = Ticks, time = 161046 True 2
Fn
Get Time type = Ticks, time = 161203 True 2
Fn
Get Time type = Ticks, time = 161312 True 2
Fn
Get Time type = Ticks, time = 161437 True 4
Fn
Get Time type = Ticks, time = 161531 True 2
Fn
Get Time type = Ticks, time = 161656 True 2
Fn
Get Time type = Ticks, time = 161796 True 2
Fn
Get Time type = Ticks, time = 161890 True 2
Fn
Get Time type = Ticks, time = 162000 True 2
Fn
Get Time type = Ticks, time = 162125 True 2
Fn
Get Time type = Ticks, time = 162234 True 2
Fn
Get Time type = Ticks, time = 162375 True 2
Fn
Get Time type = Ticks, time = 162468 True 4
Fn
Get Time type = Ticks, time = 162593 True 2
Fn
Get Time type = Ticks, time = 162703 True 2
Fn
Get Time type = Ticks, time = 162828 True 2
Fn
Get Time type = Ticks, time = 162937 True 2
Fn
Get Time type = Ticks, time = 163046 True 2
Fn
Get Time type = Ticks, time = 163171 True 2
Fn
Get Time type = Ticks, time = 163296 True 2
Fn
Get Time type = Ticks, time = 163390 True 2
Fn
Get Time type = Ticks, time = 163500 True 4
Fn
Get Time type = Ticks, time = 163609 True 2
Fn
Get Time type = Ticks, time = 163703 True 2
Fn
Get Time type = Ticks, time = 163812 True 2
Fn
Get Time type = Ticks, time = 163921 True 2
Fn
Get Time type = Ticks, time = 164109 True 2
Fn
Get Time type = Ticks, time = 164218 True 1
Fn
Get Time type = Ticks, time = 164234 True 1
Fn
Get Time type = Ticks, time = 164328 True 2
Fn
Get Time type = Ticks, time = 164453 True 2
Fn
Get Time type = Ticks, time = 164546 True 4
Fn
Get Time type = Ticks, time = 164671 True 2
Fn
Get Time type = Ticks, time = 164781 True 2
Fn
Get Time type = Ticks, time = 164890 True 2
Fn
Get Time type = Ticks, time = 165000 True 2
Fn
Get Time type = Ticks, time = 165109 True 2
Fn
Get Time type = Ticks, time = 165218 True 2
Fn
Get Time type = Ticks, time = 165328 True 2
Fn
Get Time type = Ticks, time = 165500 True 2
Fn
Get Time type = Ticks, time = 165671 True 4
Fn
Get Time type = Ticks, time = 165859 True 2
Fn
Get Time type = Ticks, time = 166000 True 2
Fn
Get Time type = Ticks, time = 166125 True 2
Fn
Get Time type = Ticks, time = 166250 True 2
Fn
Get Time type = Ticks, time = 166375 True 2
Fn
Get Time type = Ticks, time = 166515 True 2
Fn
Get Time type = Ticks, time = 166703 True 4
Fn
Get Time type = Ticks, time = 166828 True 2
Fn
Get Time type = Ticks, time = 166953 True 2
Fn
Get Time type = Ticks, time = 167078 True 2
Fn
Get Time type = Ticks, time = 167421 True 2
Fn
Get Time type = Ticks, time = 167562 True 2
Fn
Get Time type = Ticks, time = 167671 True 2
Fn
Get Time type = Ticks, time = 167796 True 4
Fn
Get Time type = Ticks, time = 167890 True 2
Fn
Get Time type = Ticks, time = 168000 True 2
Fn
Get Time type = Ticks, time = 168125 True 2
Fn
Get Time type = Ticks, time = 168234 True 2
Fn
Get Time type = Ticks, time = 168343 True 2
Fn
Get Time type = Ticks, time = 168453 True 2
Fn
Get Time type = Ticks, time = 168562 True 2
Fn
Get Time type = Ticks, time = 168671 True 2
Fn
Get Time type = Ticks, time = 168781 True 2
Fn
Get Time type = Ticks, time = 168890 True 4
Fn
Get Time type = Ticks, time = 169000 True 2
Fn
Get Time type = Ticks, time = 169109 True 2
Fn
Get Time type = Ticks, time = 170578 True 4
Fn
Get Time type = Ticks, time = 170765 True 2
Fn
Get Time type = Ticks, time = 170906 True 2
Fn
Get Time type = Ticks, time = 171031 True 2
Fn
Get Time type = Ticks, time = 171156 True 2
Fn
Get Time type = Ticks, time = 171281 True 2
Fn
Get Time type = Ticks, time = 171390 True 2
Fn
Get Time type = Ticks, time = 171500 True 2
Fn
Get Time type = Ticks, time = 171640 True 4
Fn
Get Time type = Ticks, time = 171765 True 2
Fn
Get Time type = Ticks, time = 171875 True 2
Fn
Get Time type = Ticks, time = 171984 True 2
Fn
Get Time type = Ticks, time = 172109 True 2
Fn
Get Time type = Ticks, time = 172218 True 2
Fn
Get Time type = Ticks, time = 172359 True 2
Fn
Get Time type = Ticks, time = 172468 True 2
Fn
Get Time type = Ticks, time = 172593 True 2
Fn
Get Time type = Ticks, time = 172734 True 4
Fn
Get Time type = Ticks, time = 172843 True 2
Fn
Get Time type = Ticks, time = 172953 True 2
Fn
Get Time type = Ticks, time = 173062 True 2
Fn
Get Time type = Ticks, time = 173171 True 2
Fn
Get Time type = Ticks, time = 173390 True 2
Fn
Get Time type = Ticks, time = 173500 True 2
Fn
Get Time type = Ticks, time = 173609 True 2
Fn
Get Time type = Ticks, time = 173718 True 2
Fn
Get Time type = Ticks, time = 173843 True 4
Fn
Get Time type = Ticks, time = 173953 True 2
Fn
Get Time type = Ticks, time = 174093 True 2
Fn
Get Time type = Ticks, time = 174250 True 2
Fn
Get Time type = Ticks, time = 174375 True 2
Fn
Get Time type = Ticks, time = 174500 True 2
Fn
Get Time type = Ticks, time = 174671 True 2
Fn
Get Time type = Ticks, time = 174812 True 2
Fn
Get Time type = Ticks, time = 174921 True 4
Fn
Get Time type = Ticks, time = 175031 True 2
Fn
Get Time type = Ticks, time = 175234 True 2
Fn
Get Time type = Ticks, time = 175343 True 2
Fn
Get Time type = Ticks, time = 175609 True 2
Fn
Get Time type = Ticks, time = 175750 True 2
Fn
Get Time type = Ticks, time = 175859 True 2
Fn
Get Time type = Ticks, time = 176031 True 4
Fn
Get Time type = Ticks, time = 176218 True 2
Fn
Get Time type = Ticks, time = 176515 True 2
Fn
Get Time type = Ticks, time = 176687 True 2
Fn
Get Time type = Ticks, time = 177078 True 2
Fn
Get Info type = Operating System True 2
Fn
Mutex (5)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\syncronize_AEDV8MA True 1
Fn
Create mutex_name = Global\syncronize_AEDV8MU True 1
Fn
Open mutex_name = Global\syncronize_AEDV8MA, desired_access = SYNCHRONIZE False 1
Fn
Open mutex_name = Global\syncronize_AEDV8MU, desired_access = SYNCHRONIZE False 1
Fn
Release mutex_name = Global\syncronize_AEDV8MA True 1
Fn
Process #7: 1csrss.exe
111 0
»
Information Value
ID #7
File Name c:\programdata\microsoft\windows\start menu\programs\startup\1csrss.exe
Command Line "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:21, Reason: Autostart
Unmonitor End Time: 00:04:31, Reason: Self Terminated
Monitor Duration 00:00:09
OS Process Information
»
Information Value
PID 0xda4
Parent PID 0xa08 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DA8
0x DFC
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
1csrss.exe 0x00400000 0x00418FFF Process Termination - 32-bit - False False
Host Behavior
Module (100)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x77740000 True 1
Fn
Load advapi32.dll base_address = 0x773f0000 True 1
Fn
Load user32.dll base_address = 0x76360000 True 1
Fn
Load Shell32.dll base_address = 0x75010000 True 1
Fn
Load ntdll.dll base_address = 0x77c70000 True 1
Fn
Load mpr.dll base_address = 0x74670000 True 1
Fn
Load ws2_32.dll base_address = 0x77940000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x777551b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x777550d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x777aee40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x777aed70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x7778e500 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x777aef40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x77755090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x777aef10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x77753cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x77754cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x777832c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x77783780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x777aeb70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x77756c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x77756c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x777aea10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x777aeca0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x77750d20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x777add50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x777aed40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x77756b10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x777aebb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x77756760 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77cbb250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x777af090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x777aed10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x777aebf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77cbb2d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x777aec80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x77756bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x77756bd0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c9fb90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x777aec20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x777aeab0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x777556c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x777546b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x77754a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x77755da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x77755dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x777aea20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x777af100 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x777af020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x777af180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x777af130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x777af0e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x777aedf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x777551f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77caf630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cb2dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x777557f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x77754590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x777aeae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x77754610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x77754430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x77754410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x77755cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x777567e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x777554e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x777567a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x77755010 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x7778edc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x7778f8f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x7778f750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x7740e580 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x7740e5a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x7740f530 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x7740ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x7740efb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x7740ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x77410540 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x7740fa20 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x7740fc00 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x774226d0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x77412380 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x77422f70 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x7740fc80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x7638f210 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75174730 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77ce2070 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74672640 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74672790 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74672410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x77945b40 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x77954510 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x77945030 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x77950c50 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x77945410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x77950910 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x77976cb0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x77959160 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x77958ff0 True 1
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Time type = Performance Ctr, time = 12619665687 True 1
Fn
Get Time type = Ticks, time = 126156 True 3
Fn
Get Info type = Operating System True 2
Fn
Mutex (2)
»
Operation Additional Information Success Count Logfile
Open mutex_name = Global\syncronize_AEDV8MA, desired_access = SYNCHRONIZE True 1
Fn
Open mutex_name = Global\syncronize_AEDV8MU, desired_access = SYNCHRONIZE True 1
Fn
Process #8: 1csrss.exe
111 0
»
Information Value
ID #8
File Name c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\1csrss.exe
Command Line "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:22, Reason: Autostart
Unmonitor End Time: 00:04:31, Reason: Self Terminated
Monitor Duration 00:00:09
OS Process Information
»
Information Value
PID 0xdbc
Parent PID 0xa08 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DC0
0x DF8
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
1csrss.exe 0x00400000 0x00418FFF Process Termination - 32-bit - False False
Host Behavior
Module (100)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x77740000 True 1
Fn
Load advapi32.dll base_address = 0x773f0000 True 1
Fn
Load user32.dll base_address = 0x76360000 True 1
Fn
Load Shell32.dll base_address = 0x75010000 True 1
Fn
Load ntdll.dll base_address = 0x77c70000 True 1
Fn
Load mpr.dll base_address = 0x74670000 True 1
Fn
Load ws2_32.dll base_address = 0x77940000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x777551b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x777550d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x777aee40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x777aed70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x7778e500 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x777aef40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x77755090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x777aef10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x77753cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x77754cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x777832c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x77783780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x777aeb70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x77756c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x77756c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x777aea10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x777aeca0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x77750d20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x777add50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x777aed40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x77756b10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x777aebb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x77756760 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77cbb250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x777af090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x777aed10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x777aebf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77cbb2d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x777aec80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x77756bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x77756bd0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c9fb90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x777aec20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x777aeab0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x777556c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x777546b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x77754a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x77755da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x77755dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x777aea20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x777af100 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x777af020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x777af180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x777af130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x777af0e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x777aedf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x777551f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77caf630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cb2dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x777557f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x77754590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x777aeae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x77754610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x77754430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x77754410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x77755cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x777567e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x777554e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x777567a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x77755010 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x7778edc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x7778f8f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x7778f750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x7740e580 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x7740e5a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x7740f530 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x7740ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x7740efb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x7740ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x77410540 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x7740fa20 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x7740fc00 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x774226d0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x77412380 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x77422f70 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x7740fc80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x7638f210 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75174730 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77ce2070 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74672640 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74672790 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74672410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x77945b40 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x77954510 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x77945030 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x77950c50 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x77945410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x77950910 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x77976cb0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x77959160 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x77958ff0 True 1
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Time type = Performance Ctr, time = 12620157642 True 1
Fn
Get Time type = Ticks, time = 126171 True 3
Fn
Get Info type = Operating System True 2
Fn
Mutex (2)
»
Operation Additional Information Success Count Logfile
Open mutex_name = Global\syncronize_AEDV8MA, desired_access = SYNCHRONIZE True 1
Fn
Open mutex_name = Global\syncronize_AEDV8MU, desired_access = SYNCHRONIZE True 1
Fn
Process #9: cmd.exe
284 0
»
Information Value
ID #9
File Name c:\windows\system32\cmd.exe
Command Line "C:\WINDOWS\system32\cmd.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:30, Reason: Child Process
Unmonitor End Time: 00:04:46, Reason: Self Terminated
Monitor Duration 00:00:16
OS Process Information
»
Information Value
PID 0xe78
Parent PID 0xd88 (c:\windows\system32\1csrss.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x E7C
0x EE4
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
cmd.exe 0x7FF790A40000 0x7FF790AA2FFF Process Termination - 64-bit - False False
Host Behavior
File (218)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\WINDOWS\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 14
Fn
Get Info STD_INPUT_HANDLE type = file_type True 7
Fn
Open STD_OUTPUT_HANDLE - True 36
Fn
Open STD_INPUT_HANDLE - True 81
Fn
Read STD_INPUT_HANDLE size = 1, size_out = 1 True 65
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 2 True 5
Fn
Data
Write STD_OUTPUT_HANDLE size = 52 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 20 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 36 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 5 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 4, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\mode.com os_pid = 0xef8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\WINDOWS\system32\vssadmin.exe os_pid = 0xf24, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info C:\WINDOWS\system32\mode.com type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info C:\WINDOWS\system32\vssadmin.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Memory (2)
»
Operation Process Additional Information Success Count Logfile
Read C:\WINDOWS\system32\mode.com address = 639504076800, size = 1952 True 1
Fn
Data
Read C:\WINDOWS\system32\vssadmin.exe address = 524031717376, size = 1952 True 1
Fn
Data
Module (10)
»
Operation Module Additional Information Success Count Logfile
Load NTDLL.DLL base_address = 0x7fffc5a80000 True 1
Fn
Get Handle c:\windows\system32\cmd.exe base_address = 0x7ff790a40000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x7fffc5200000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x7fffc521a990 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x7fffc521e830 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x7fffc521e300 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x7fffc2410a40 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x7fffc5b256b0 True 1
Fn
System (1)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 1
Fn
Environment (30)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 10
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps; True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 3
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 3
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 2
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 2
Fn
Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Process #11: mode.com
0 0
»
Information Value
ID #11
File Name c:\windows\system32\mode.com
Command Line mode con cp select=1251
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:36, Reason: Child Process
Unmonitor End Time: 00:04:41, Reason: Self Terminated
Monitor Duration 00:00:04
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xef8
Parent PID 0xe78 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x EFC
0x F04
0x F08
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
mode.com 0x7FF611CE0000 0x7FF611CEBFFF Process Termination - 64-bit - False False
Process #12: vssadmin.exe
0 0
»
Information Value
ID #12
File Name c:\windows\system32\vssadmin.exe
Command Line vssadmin delete shadows /all /quiet
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:04:40, Reason: Child Process
Unmonitor End Time: 00:04:46, Reason: Self Terminated
Monitor Duration 00:00:05
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xf24
Parent PID 0xe78 (c:\windows\system32\cmd.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x F28
0x F2C
0x F34
0x F38
0x F3C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
vssadmin.exe 0x7FF6912F0000 0x7FF691316FFF Process Termination - 64-bit - False False
Process #14: 1csrss.exe
11508 0
»
Information Value
ID #14
File Name c:\windows\system32\1csrss.exe
Command Line "C:\Windows\System32\1csrss.exe" -a
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:05:16, Reason: Child Process
Unmonitor End Time: 00:05:22, Reason: Terminated by Timeout
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0xc50
Parent PID 0xd88 (c:\windows\system32\1csrss.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C64
0x C60
0x B84
0x B7C
0x 878
0x AD0
0x 86C
0x C34
0x C30
0x C2C
0x C38
0x C1C
0x C18
0x C0C
0x D30
0x DDC
0x D6C
Host Behavior
File (1981)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\System32\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\WINDOWS\System32\1csrss.exe desired_access = GENERIC_WRITE False 1
Fn
Create C:\Users\FD1HVy\AppData\Roaming\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Windows\System32\1csrss.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1csrss.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\$WINRE_BACKUP_PARTITION.MARKER desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bg-BG\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootspaces.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\bootvhd.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\updaterevokesipolicy.p7b desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE, GENERIC_READ False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[lockhelp@qq.com].gate desired_access = GENERIC_WRITE True 1
Fn
Create Pipe Anonymous read pipe size = 0 True 1
Fn
Create Pipe Anonymous read pipe size = 0 True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini type = size, size_out = 129 True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini type = file_attributes True 1
Fn
Get Info C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[lockhelp@qq.com].gate type = file_attributes True 1
Fn
Get Info C:\$WINRE_BACKUP_PARTITION.MARKER type = size, size_out = 0 True 1
Fn
Get Info C:\Boot\BCD.LOG1 type = size, size_out = 0 True 1
Fn
Get Info C:\Boot\BCD.LOG2 type = size, size_out = 0 True 1
Fn
Get Info C:\Boot\bg-BG\bootmgr.exe.mui type = size, size_out = 77664 True 1
Fn
Get Info C:\Boot\bg-BG\bootmgr.exe.mui type = file_attributes True 1
Fn
Get Info C:\Boot\bg-BG\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\bootspaces.dll type = size, size_out = 95648 True 1
Fn
Get Info C:\Boot\bootspaces.dll type = file_attributes True 1
Fn
Get Info C:\Boot\bootspaces.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\bootvhd.dll type = size, size_out = 99744 True 1
Fn
Get Info C:\Boot\bootvhd.dll type = file_attributes True 1
Fn
Get Info C:\Boot\bootvhd.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\cs-CZ\bootmgr.exe.mui type = size, size_out = 76632 True 1
Fn
Get Info C:\Boot\cs-CZ\bootmgr.exe.mui type = file_attributes True 1
Fn
Get Info C:\Boot\cs-CZ\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\updaterevokesipolicy.p7b type = size, size_out = 4662 True 1
Fn
Get Info C:\Boot\updaterevokesipolicy.p7b type = file_attributes True 1
Fn
Get Info C:\Boot\updaterevokesipolicy.p7b.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml type = size, size_out = 791421 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Content.xml type = size, size_out = 27045 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Content.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\Content.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi type = size, size_out = 111320 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi type = size, size_out = 48936 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi type = size, size_out = 46622 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi type = size, size_out = 84190 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\cs-CZ\memtest.exe.mui type = size, size_out = 45472 True 1
Fn
Get Info C:\Boot\cs-CZ\memtest.exe.mui type = file_attributes True 1
Fn
Get Info C:\Boot\cs-CZ\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Boot\da-DK\bootmgr.exe.mui type = size, size_out = 75616 True 1
Fn
Get Info C:\Boot\da-DK\bootmgr.exe.mui type = file_attributes True 1
Fn
Get Info C:\Boot\da-DK\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll type = size, size_out = 18624 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm type = size, size_out = 255 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg type = size, size_out = 1074 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm type = size, size_out = 231 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg type = size, size_out = 23871 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm type = size, size_out = 237 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm type = size, size_out = 21184 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll type = size, size_out = 18624 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll type = size, size_out = 19136 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml type = size, size_out = 527958 True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml type = size, size_out = 1261 True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml type = size, size_out = 3375 True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml type = size, size_out = 2173046 True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml type = size, size_out = 373 True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF type = size, size_out = 9024 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF type = size, size_out = 7216 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF type = size, size_out = 14873 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll type = size, size_out = 19136 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll type = size, size_out = 18624 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll type = size, size_out = 11616 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll type = size, size_out = 19648 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF type = size, size_out = 6684 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF type = size, size_out = 3251 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF type = size, size_out = 8097 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF type = size, size_out = 7686 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF type = size, size_out = 11891 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll type = size, size_out = 22720 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll type = size, size_out = 19136 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll type = size, size_out = 20672 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll type = size, size_out = 19648 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll type = size, size_out = 19136 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll type = size, size_out = 27840 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll type = size, size_out = 26816 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll type = size, size_out = 70848 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll type = size, size_out = 19648 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF type = size, size_out = 517 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll type = size, size_out = 23232 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll type = size, size_out = 24768 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll type = size, size_out = 24768 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll type = size, size_out = 21184 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll type = size, size_out = 19136 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll type = size, size_out = 162880 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll type = size, size_out = 656088 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe type = size, size_out = 2054872 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll type = size, size_out = 307416 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll type = size, size_out = 2118360 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll type = size, size_out = 468696 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll type = size, size_out = 396960 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll type = size, size_out = 473760 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF type = size, size_out = 502 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF type = size, size_out = 12702 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF type = size, size_out = 3484 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF type = size, size_out = 3140 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF type = size, size_out = 12482 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF type = size, size_out = 5253 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll type = size, size_out = 210648 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll type = size, size_out = 1402584 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll type = size, size_out = 1761448 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF type = size, size_out = 10607 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF type = size, size_out = 15308 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF type = size, size_out = 5315 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF type = size, size_out = 4955 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF type = size, size_out = 5030 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF type = size, size_out = 2596 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF type = size, size_out = 1146 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF type = size, size_out = 7583 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF type = size, size_out = 6984 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll type = size, size_out = 2285736 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll type = size, size_out = 567512 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll type = size, size_out = 1231576 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll type = size, size_out = 947928 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll type = size, size_out = 1295576 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll type = size, size_out = 512216 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF type = size, size_out = 13254 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF type = size, size_out = 8582 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF type = size, size_out = 4894 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF type = size, size_out = 5375 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF type = size, size_out = 9248 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF type = size, size_out = 5016 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF type = size, size_out = 4390 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF type = size, size_out = 3966 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF type = size, size_out = 3378 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF type = size, size_out = 3120 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF type = size, size_out = 3026 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF type = size, size_out = 4734 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF type = size, size_out = 5684 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe type = size, size_out = 263896 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF type = size, size_out = 20578 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF type = size, size_out = 10832 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF type = size, size_out = 14428 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF type = size, size_out = 7072 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll type = size, size_out = 820416 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF type = size, size_out = 3344 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF type = size, size_out = 1596 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF type = size, size_out = 7968 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF type = size, size_out = 1832 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF type = size, size_out = 26332 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll type = size, size_out = 1208928 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF type = size, size_out = 27858 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF type = size, size_out = 3746 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF type = size, size_out = 5836 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF type = size, size_out = 3012 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF type = size, size_out = 2756 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll type = size, size_out = 902328 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF type = size, size_out = 7372 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF type = size, size_out = 7540 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF type = size, size_out = 6632 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF type = size, size_out = 2108 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF type = size, size_out = 9240 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll type = size, size_out = 332968 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash type = size, size_out = 102 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash type = size, size_out = 102 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe type = size, size_out = 1093248 True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe type = file_attributes True 1
Fn
Get Info C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF type = size, size_out = 2344 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF type = size, size_out = 6060 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF type = size, size_out = 3416 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF type = size, size_out = 2636 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF type = size, size_out = 6636 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF type = size, size_out = 4612 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF type = size, size_out = 3144 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF type = size, size_out = 7668 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF type = size, size_out = 8492 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF type = size, size_out = 7804 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF type = size, size_out = 7804 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF type = size, size_out = 2016 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF type = size, size_out = 2492 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF type = size, size_out = 3348 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF type = size, size_out = 4296 True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF type = file_attributes True 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate type = file_attributes False 1
Fn
Get Info C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF type = size, size_out = 3228 True 1
Fn
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate size = 16000 True 1
Fn
Data
Write C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 1264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 3376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate size = 9840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate size = 262 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate size = 384 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate size = 256 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 9040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 18640 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 274 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 18640 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 274 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 21200 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 290 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate size = 19152 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate size = 294 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 6688 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 8112 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7696 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19152 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 276 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 18640 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 282 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 11632 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19664 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 274 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 20688 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 284 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 22736 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 27856 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 272 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19152 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate size = 786714 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19664 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 26832 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 282 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 70864 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 286 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19664 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 23248 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 24784 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 274 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 19152 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 278 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 24784 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 276 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 21200 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 272 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 527968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate size = 318 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 512 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 14880 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 12704 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3488 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 12496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 11904 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate size = 473776 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate size = 250 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 10608 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 15312 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5328 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 4960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 2608 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 1152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate size = 786698 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 7584 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 6992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate size = 276 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate size = 396976 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate size = 250 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 13264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 8592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 4896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 4400 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate size = 786714 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 9264 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 5376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3392 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 3136 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3040 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4736 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate size = 512224 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate size = 246 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 20592 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 10848 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14432 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate size = 263904 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1600 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7984 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 1840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 27872 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3760 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5840 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3024 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5696 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7376 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7552 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2112 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate size = 902336 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate size = 242 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate size = 820432 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate size = 786714 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate size = 262144 True 3
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate size = 1048560 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[lockhelp@qq.com].gate size = 112 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[lockhelp@qq.com].gate size = 112 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7088 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2352 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6064 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3424 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26336 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4624 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3152 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7680 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 8496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2768 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2496 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3360 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4304 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate size = 160384 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate size = 230 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate size = 1048560 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate size = 358624 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate size = 242 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate size = 332976 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate size = 238 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate size = 61040 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate size = 250 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 6640 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4816 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 5008 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7808 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26896 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 28960 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 11648 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 2032 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16192 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 17248 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16128 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 3232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 26752 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4928 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4080 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate size = 44704 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate size = 252 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 4880 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 24784 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[lockhelp@qq.com].gate size = 982736 False 1
Fn
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate size = 996576 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate size = 244 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate size = 390336 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate size = 242 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 48000 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 40208 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 22528 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 14544 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 20560 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 7968 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 13520 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 16688 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 20464 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 15744 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 12992 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 9712 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 236 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[lockhelp@qq.com].gate size = 363744 True 1
Fn
Data
Write C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[lockhelp@qq.com].gate size = 232 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate size = 24336 False 1
Fn
For performance reasons, the remaining 961 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (8)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = 83, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run value_name = 1csrss.exe, data = C:\Users\FD1HVy\AppData\Roaming\1csrss.exe, size = 84, type = REG_SZ True 1
Fn
Process (192)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\cmd.exe os_pid = 0xb88, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Enumerate Processes - - True 187
Fn
Enumerate Processes - - False 4
Fn
Module (139)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x77740000 True 1
Fn
Load advapi32.dll base_address = 0x773f0000 True 1
Fn
Load user32.dll base_address = 0x76360000 True 1
Fn
Load Shell32.dll base_address = 0x75010000 True 1
Fn
Load ntdll.dll base_address = 0x77c70000 True 1
Fn
Load mpr.dll base_address = 0x74670000 True 1
Fn
Load ws2_32.dll base_address = 0x77940000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x77740000 True 18
Fn
Get Filename - process_name = c:\windows\system32\1csrss.exe, file_name_orig = C:\Windows\System32\1csrss.exe, size = 32767 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x777551b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x777550d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x777aee40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x777aed70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x7778e500 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x777aef40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x77755090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x777aef10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x77753cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x77754cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x777832c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameA, address_out = 0x77783780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x777aeb70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x77756c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x77756c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x777aea10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x777aeca0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x77750d20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x777add50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x777aed40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x77756b10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x777aebb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x77756760 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77cbb250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x777af090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x777aed10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenMutexW, address_out = 0x777aebf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77cbb2d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x777aec80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x77756bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x77756bd0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c9fb90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x777aec20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x777aeab0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x777556c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x777546b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x77754a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x77755da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x77755dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x777aea20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x777af100 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x777af020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x777af180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x777af130 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x777af0e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x777aedf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x777551f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77caf630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77cb2dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x777557f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreatePipe, address_out = 0x77754590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetHandleInformation, address_out = 0x777aeae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x77754610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x77754430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x77754410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x77755cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x777567e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x777554e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SystemTimeToFileTime, address_out = 0x777567a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x77755010 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x7778edc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x7778f8f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x7778f750 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x7740e580 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x7740e5a0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x7740f530 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x7740ed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x7740efb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x7740ee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x77410540 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x7740fa20 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x7740fc00 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x774226d0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x77412380 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumDependentServicesW, address_out = 0x77422f70 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = EnumServicesStatusExW, address_out = 0x7740fc80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SystemParametersInfoW, address_out = 0x7638f210 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75174730 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = NtQuerySystemInformation, address_out = 0x77ce2070 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74672640 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74672790 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74672410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = WSAStartup, address_out = 0x77945b40 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = socket, address_out = 0x77954510 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = send, address_out = 0x77945030 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = recv, address_out = 0x77950c50 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = connect, address_out = 0x77945410 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = closesocket, address_out = 0x77950910 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = gethostbyname, address_out = 0x77976cb0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = inet_addr, address_out = 0x77959160 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = ntohl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htonl, address_out = 0x779449d0 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = htons, address_out = 0x77958ff0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x77756b30 True 18
Fn
Service (15)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (49)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = NQDPDE True 1
Fn
Sleep duration = -1 (infinite) False 1
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 3
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 15
Fn
Get Time type = Performance Ctr, time = 17581255635 True 1
Fn
Get Time type = Ticks, time = 175781 True 3
Fn
Get Time type = Ticks, time = 176203 True 2
Fn
Get Time type = Ticks, time = 176500 True 2
Fn
Get Time type = Ticks, time = 176687 True 2
Fn
Get Time type = Ticks, time = 177078 True 2
Fn
Get Time type = Ticks, time = 177859 True 4
Fn
Get Time type = Ticks, time = 178296 True 2
Fn
Get Time type = Ticks, time = 178453 True 2
Fn
Get Time type = Ticks, time = 178890 True 2
Fn
Get Time type = Ticks, time = 179203 True 2
Fn
Get Time type = Ticks, time = 179390 True 1
Fn
Get Time type = Ticks, time = 179703 True 1
Fn
Get Time type = Ticks, time = 179843 True 1
Fn
Get Info type = Operating System True 2
Fn
Mutex (2)
»
Operation Additional Information Success Count Logfile
Open mutex_name = Global\syncronize_AEDV8MA, desired_access = SYNCHRONIZE True 1
Fn
Open mutex_name = Global\syncronize_AEDV8MU, desired_access = SYNCHRONIZE True 1
Fn
Process #15: cmd.exe
4 0
»
Information Value
ID #15
File Name c:\windows\system32\cmd.exe
Command Line "C:\WINDOWS\system32\cmd.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:05:17, Reason: Child Process
Unmonitor End Time: 00:05:22, Reason: Terminated by Timeout
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0xb88
Parent PID 0xc50 (c:\windows\system32\1csrss.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B1C
0x BE0
Host Behavior
Registry (1)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x7ff790a40000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x7fffc5200000 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x7fffc521a990 True 1
Fn
Process #17: cmd.exe
0 0
»
Information Value
ID #17
File Name c:\windows\system32\cmd.exe
Command Line "C:\WINDOWS\system32\cmd.exe"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:05:19, Reason: Child Process
Unmonitor End Time: 00:05:22, Reason: Terminated by Timeout
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xd74
Parent PID 0xd88 (c:\windows\system32\1csrss.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D70
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image