9c63223d...96b9 | Grouped Behavior
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Trojan

cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe

Windows Exe (x86-32)

Created at 2019-05-16T14:45:00

Monitored Processes

Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9a8 Analysis Target High (Elevated) cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe" -
#2 0x9b4 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" #1
#3 0x9e0 Child Process High (Elevated) mode.com mode con cp select=1251 #2
#4 0xa18 Child Process High (Elevated) vssadmin.exe vssadmin delete shadows /all /quiet #2
#5 0xabc RPC Server System (Elevated) vssvc.exe C:\Windows\system32\vssvc.exe #4

Behavior Information - Grouped by Category

Process #1: cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe
29664 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:23, Reason: Analysis Target
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:33
OS Process Information
»
Information Value
PID 0x9a8
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9AC
0x 9B0
0x 9BC
0x 9C0
0x 9C4
0x 9C8
0x 9CC
0x 9E8
0x 9EC
0x 9F0
0x 9F4
0x 9F8
0x 9FC
0x A00
0x A04
0x A08
0x A0C
0x A34
0x A44
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe 0x00400000 0x00418FFF Relevant Image - 32-bit - True False
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe 92.50 KB MD5: 1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17
SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.55 KB MD5: 53d0b079d6fce1269dc5fe9e75fc9c6f
SHA1: 7de7bc6ac065c5e320404310a184ca89a00d574e
SHA256: bcc135bea8de1e66e2f2b6d01346c22966f2a047568688515f730c960d3544df
SSDeep: 24:+gV+SQCROSO38gLVYFtl8/ezDUcWL6rs2UyXJDQvbo9TdEcZ8AwVEMmDI8qr6E+7:+ggSJwMgL+3Uf6reytIu9Zk9x4iNm6c/
False
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.44 KB MD5: 9207458f4cad805057cc8ca83b332cf0
SHA1: d5e2954af0b220600450377d7a893894e9ef321f
SHA256: 1860491676ae364f8cdd5a50a5e6e6eabd6b3cdce435a456e586c3876f4a475b
SSDeep: 24:OD5Ui0x9meoLUWX1n83zjVDNzDPwaOioApRbNwYdcd3Ez4Kmh+p2+zbOeLtVcD:OVUib9n8XVDNHPw/io+234DmQH2eDcD
False
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 3c03ca759139818de3a4408c6ec39906
SHA1: 91b1c3dc3545b423e9b204f649ce31cc459192e6
SHA256: a3ce4e2daef7eb129d63e1d676ccac3bbd6467d0f4a4ea65ce9324fbab42501f
SSDeep: 24:/ayI5RqsLHiQc4YL7W8ep81qh3Dtf6iVZZ2/0kSoeadrDi1As225emeAtVc9:9Q0um7W8e3DgeZA0kSoealius2set4c9
False
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.14 KB MD5: cb0d32878116323a9887777fdbd55c91
SHA1: b2b09f6f440665e8e4fa7e3868e07edce391fd57
SHA256: a8a89f62d27e8bf8304b0e52603d4bf23c78bad825f68f92d8f3a7c67cb30720
SSDeep: 24:CBIqUlh2Jtpu4c2pTLTun2eUy+v2PsoWVYpeOotVcn:JqUgpuSP6n2eT+uPYce/cn
False
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.18 KB MD5: 796b6f2ea699af44d325b663765d9841
SHA1: 72f99535c833aaac31dd4e81ad7435e3ff141f39
SHA256: 6e6b9e8794b3336504d88133a8656b68fd002943b7fbe80de654bee9c85c6c38
SSDeep: 48:5SiB4Yz4Zm0UQmsg5Ao4yfg6r+X5DWVEBcjrlZDadFhqY73li5c/:1OFPABGDWEBsrioY73li5c/
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 9.37 KB MD5: 87e66004b0f5a8a6701823cba8b75155
SHA1: b3a1e53f99df175203eb7be62a93294ef4875bf0
SHA256: acb7a3e55fe8c3bb14dc1c7ceacabf43691f0a1a0e0d1dbef91062ae626103bb
SSDeep: 192:UcgSyUJihlq+G30mtng7wB5LU2cRu1wjQJU9xjNz+BKfI5jc/:UcgUMhlqxLOJRuWjxJI5Y/
False
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 16.94 MB MD5: 2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai
False
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry 582.61 KB MD5: f8d876e8c600820cbe679b0eb3acd4cb
SHA1: d5df6c2702f344c233af38eed2454329748451ce
SHA256: 6a82efa51e5037b79a5b5b89a56beb02e331ec87418029afa9f77f51f1cc1a03
SSDeep: 12288:D5rDMHQ0v5eDFM2jit+hRDh1BNeeeplr7fWoevXvP7:s58MQrhFDBNil3fWXr
False
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 20.33 KB MD5: 8254008843a6a323a17069d774783400
SHA1: 14e7a803ca7313614bb8ebf9caf46f40bdb8aec6
SHA256: 0e851ca644319797e3a5a3cfd53fa5bfed0f2bdb08ec07f7d149f8d58515ff77
SSDeep: 384:7himDuKyD8+mC2aUmPYgN7VpVxAtlgTqUmwXQExc7vcnujX80LDkuXBd1jnB/:1igLyfmC2OPYgVjfSlg4oJCzdkuXBd1x
False
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry 14.94 KB MD5: 1d7317e6f50f1f0b2c4627bf8d6ed645
SHA1: c31634702383e524ab55d7efef4c613a397bcdce
SHA256: fec6f8bc4d8e3ccb12011401805f2cd2dfb83254b400b213aad65fbf8524b7f3
SSDeep: 384:wPfZkah1oYh1qrJ3fLRUzqmpX/yRqh7V6yN:OuYh1q93jaOml/yRewyN
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.56 KB MD5: 17b09d9b52c16ecbbb42dc958147cf46
SHA1: ff80e0366070bcc03db55a20db60b05241c5544b
SHA256: 28f2de35d6278d2c729c5cb2268adbc2c6333df144f7c5a8068f6afec6faf3eb
SSDeep: 48:+LL4V/aQCawlGwElvsn1zUoDzoYvBgXidcn:G4VJwcla2WVtcn
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.60 KB MD5: 223c1e7be67176eaea1f4e63378670fd
SHA1: 72c50151c5825aeb5aaf1e64fae0ebb71163ce55
SHA256: 541836775b994ea081f2c726fec7496a5bf5a8a43216dc236f337ffd971ea046
SSDeep: 24:gHg9oyEO4K56TsfD6fY9sXjXcwb/ZYEPpY9LvykPXiwBYSXe8x2wO1dCuQrk2lRH:gAZ6Yb6esXxHpSvyLwmSX61er12cD
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry 582.61 KB MD5: 0c2968dc4fb120c72e922a1c48b5793d
SHA1: 91f2ff064b0c3075a5714df387889062bb12db71
SHA256: 7f1a8b2005eef3537eb5390a76164d0d6a08d5d7a3b2bcb3e75d8decd6ee1ab2
SSDeep: 12288:WhDRpJFVLYnU4698rNVwx3BXxDGkP+4cUj4yWu2aJMXzjIFOLPVS5:WZL9oI3V9HPZcUj4yWzcMjjak2
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 3.36 KB MD5: f434f208ecbc883fc6b494a4a693f383
SHA1: 837366e104247b0942a1c81fe31a932290ae6e2f
SHA256: e8318ea37b8060da8de1a8253f92e4eeea094ff8aec363c0fedc2fa653c76ffb
SSDeep: 96:YevLWaG1LvMiM2FvK0w6DihYWu37sQd6GKfMKc9:YkL+LvMiM9DICQ7szRDc9
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 5.97 KB MD5: cf6c283fdbc1de17445218ac037c9931
SHA1: dad4fb6d9cfbbab7eafd7a59c60367cb844cdca7
SHA256: aa5a72ffcd2e745787f921bd69fb3af3d94deaff948d2e7822ff9498430fb45b
SSDeep: 96:L6H1fKL/3ot4knfMRgXDRhv6S6RylKeJLfe75bdd72tnZl4sUwMKdWtBfHM1XRan:L6Vf+/4dMSv6NIJmVbddSnr4scACHELm
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry 865.24 KB MD5: d8859124dc9909b335a2e52061cd8705
SHA1: a6a273793f20e642dd041c6650730f828a7dd0ae
SHA256: 93e936e1675f450c11f90d9cd6580cf65628130dc26fcb66e0574df527344915
SSDeep: 24576:O32NohAYA3KDn4NqxoQiP9y1EtI67UJBBGOmou+ATqjCjTOLybzUc:2YsjjxM+iMBBGOmoNATvOu3Uc
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.85 KB MD5: 06f7ca124e096b1fe207a372d0398cf0
SHA1: f079e33e1d93a3099ce92aaa8619cb4be00cbe12
SHA256: 6ae7bba2748f36ebc57bd8f711d261bbc3aaab5c733c6167ccf67b50cf1e93ad
SSDeep: 48:QJeeRoiXKP0bGeoYdHaWzJO8pwwJOFBxDf5Er4OSV5/yodTpcAfIkwctGJLnOTcV:qeeRrzHHPz2mOFjf55OsDTpwvwcV
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[decryptoperator@qq.com].cry 8.94 KB MD5: 4d8cc00fc954583e059ddae5f05d0fbc
SHA1: 16e4918c5b70b4763764ad187e69a110122ec535
SHA256: 448d90537c42b939f172a500ebac933cff9cfe97a7a1f238f4a4a933792ff588
SSDeep: 192:01+eh9Qlsx/uvjr6fcBqmjKNqDjwd6Kdax9XEGSa8kwAe5uN+hjoP6c/:UTQA/uvCQKNqDUpMT0GJ8NFINajoJ/
False
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decryptoperator@qq.com].cry 3.54 MB MD5: 2da937cddbde9bcda2bd6d5018ef33a5
SHA1: 8414c016f7e0f8a69c5bc3ff0c260b7f09d62906
SHA256: 6bedaaaff93668292eeda5ca80fd13d25a023cb5383b81dbb1d47f11af6928ad
SSDeep: 49152:AeFNMMFrwnbddIOxFOSOwPFhbYRjfIDPHLoBTv5oJBB47q5FqciqlqjX6nM:zDMUwxyODPFhbY12HLodiF4+5riKeoM
False
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry 378 bytes MD5: da5f19a08dd26102d76fbb78b074d4b7
SHA1: 418386b0e865c4bd995bb3d51499136fa2c8374d
SHA256: 4cc396c233a48dd41f02f16952d724ee93fefbb6b74fd5b70c40548d222a7738
SSDeep: 6:UlFRz80kxtd5LVbs8mSU6WCt9qiNIhHcwNlnpE4S48s4Rim5D6C/QXet:Enkxv5Ly8/HNIhHcUtlS4cju6
False
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decryptoperator@qq.com].cry 64.25 KB MD5: f89fd741eaf7ddeaadb5bf8d08cdce7d
SHA1: 734d6db24572f16d5e241a3860a347cebe9826a5
SHA256: 14a36df853b30eae5eae92508d1a4d63314b3248113278458cdca132f1331167
SSDeep: 768:mmGt+0EEm9pPjWs/vhx2yP7CuUJFlKlO0Y1GQdhTpB9LxvntgbDUA3aNqQ8+DHI1:EdA6+hfTCFRKlusclTntgsoQ8CHI8TsR
False
C:\BOOTSECT.BAK.id-9C354B42.[decryptoperator@qq.com].cry 8.25 KB MD5: 49931ea503aef3c813d1c9336e4fb02f
SHA1: f73c54ae30a6fcbcb2b53029f98ef08fd7ccacda
SHA256: 7307dadaed2826eea9dfee747cf20619726013304acf00530dd79f8cf3c43f06
SSDeep: 192:UYgqGiv0xeI8B0ZssP3nSSedsDkPjuo5KbYIGcR:F70xePWZ/3redsDkMR
False
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: fbb9127ea9bf97d78f589505a0a6281f
SHA1: 87345ae195e87b155a8da3b07f7ea373b7329a79
SHA256: e0698f5975bacd9c3f20f5d660707789dc62e4457363e42926c7f2152412ed6e
SSDeep: 48:xAp8vUKdWhF0UXsHmQKdzgEcnEJe9pes5fn0teWcv:s8vUKdWhF00JrdzuX58cv
False
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: da53a2fa054331cac2eed871a8cb1348
SHA1: 3583dbfde95742a09049ca5472de8f0c2f4a5283
SHA256: 374129657504bdb29533e0d168ef29040a1b06333941de80aebddf167de0a931
SSDeep: 24:nHffyJVAIWfh5ZWoOs5XTXSHVsJPQvFDGI/vH3dOy61sNYxpfrSVF6jVXKH4KQnT:nHnZXl3lTCSMFNOPDfuqXKH4KnOeXcZ
False
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.80 KB MD5: 35bcc9404a17d31dc9456b6b1d0e5992
SHA1: 78b7da896d695df0c0b24400c34dc802500ddab4
SHA256: 7a41026b2e94f704cdd337d57586214afc995219917d2e7a4c61b2fefd5252a0
SSDeep: 48:DWWngfkypgb+HBVWz88e59i8iGk9lir1rLu+524LO0c/:DLmhabEp8f+524LO0c/
False
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.07 KB MD5: 55a36659db0e51f1faea534f72d0ed68
SHA1: f05a92ba98071dc8474f72608b862aa423978557
SHA256: 8843b34160d622765a62c6c173b74673f2c9a88c087548e50b3eea149bae053e
SSDeep: 48:L0fOx46u864wweuVXKR4aTbk+5AfylaEXEVFirSvcSc/:wGJRwwjOTVaHFVcSc/
False
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.76 KB MD5: f754bc22c636917c9a705da9ffda3d9e
SHA1: 8bda1e17bf887ae90a709c3de3df99fb4a4aa162
SHA256: 33d6591999c32bc4e36b7c7318086fe4861c70e847f88a97819c1bc71af654ae
SSDeep: 48:HZv24WSLvM6ol6L9HZXY7y4ZhWNmB5dke1cR:HZvxhjulGTX+7bWNmLLcR
False
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 3.36 KB MD5: b61bef7b1ff22f68be00fac000738d9d
SHA1: 37ddcdc37a1535bfc1542b82be0482a84b23b85b
SHA256: 64cde24c03ba4afccc819f0532f83d5d5e6e6f79768cad22ab2c63e39e46bdfd
SSDeep: 96:ILRq5Zyi/y2s49eVycA5fh+WPrzOvxFZKYc9:ILRqyi//soeUcA5fcWHUxFJc9
False
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.60 KB MD5: da2cd4c0fec8e59b1b23bf915de53de8
SHA1: 4da4ae979e8cf30008556c9c0a3c4a08f554049d
SHA256: eca2fbc45349ac8a8cc5298c2970d888043f2d415a75ee6618aaefbe0f8622bc
SSDeep: 48:+EOBvMB7eFbQVsJF0CzABmfDVupRlL32Lb3YhezKlcDHbEdNzzcQ/EDT0rQR5i3m:+5BrbQVsJK0ABmfxeliLbC0KlcTb6pwb
False
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.99 KB MD5: 72c69099d419f05734021059a4e3f72f
SHA1: 7002c63ffd4e51ce880219abca5e1869a20b4917
SHA256: 42700bf08c9feba88a0b5c6b11603c2bbfed9771959c884162fd5591bf150130
SSDeep: 24:f3E59RtFhulc+ll7oNrXVzdDTrqs0W5B9BHwZW8VuVNtGXvOXtCkIeVHoLezxSem:PZcR3DTKENHwYVN+upXt+vejc7
False
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 4.33 KB MD5: 1841d0d5817c4ed12b0e8662f9f59907
SHA1: f488cee894b5f723843d4554fdfb1ad2f2274250
SHA256: 192298b8c186a1f3b544df0e0359a4deb9d039587b545b4c469f8482b449ddee
SSDeep: 96:sM9vQulcQwrC0hsZIUkagfG5DmN+RvrjFewVV4RO1+fc/:sM9vQulPuIHxgGXXzcUGc/
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 12d3d4ab325f8d311946ff9e204c17eb
SHA1: 547c530641c09bd231a4465a059778902331dcf4
SHA256: 71405985ab007c9f38adb3477026f7f3764a9700bc0b58461d1f167879e8f51f
SSDeep: 48:61CYN+sXIxRe66LvSwRovKc0+sBoWR2CBc/:/YNwRJ6Laa3JBoWR2CBc/
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 1e2cbd179dc504ad580a1919664b2e75
SHA1: bd827807d223b14f27da2e8b25bc12665ed645c4
SHA256: 2f6ac3952e34dced8c6eb0146e2b2a5d5e7c4959682dfd443476f4d6d3fb0563
SSDeep: 48:vb4rd/kMjEvotfJtmWKLgzCTVeTd4F16c/:EB1AsTQgz+ks6c/
False
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.47 KB MD5: 2648af17a20e0e8dfcd0c92ec0983a52
SHA1: eedb39c66b019fc68c5eea55c6a797f9dec252e4
SHA256: 5b54a351c6bcd7c5a07b1819f1faf23621a52001b78587a6e3032d76a808171f
SSDeep: 48:ZPAkfOihEerGoOWsfewKoktSSbqcqw7FLcqmGwPcnHQYIKc/:ZQeSoOWoewKf0qqctcynwJKc/
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.03 KB MD5: 4b4c8c01b9938942321b4a282487d99e
SHA1: 0832b3f5cf7b47098689f0a9790a8ef41483a0cb
SHA256: 021b02943f88be361540a308a9ce89c12d4ce8d3e44a956506564719bc014a9d
SSDeep: 24:Pqo6XaLsTQ6aZsjZPnGLxclqX/hUNvztkhLzcYvpiVtVcTt:PsBaSXlqXqLtuLFpi1cR
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 5.97 KB MD5: 029efbdddec0121d97139fb7fed1ce53
SHA1: 9d1d4a151954715ba247072d75af3c81bfb32b5f
SHA256: c01b62e99a83bc82fabeaf95801fa53a56ea47ff09b8fd5a02424604d8475fba
SSDeep: 96:/bjHGgY4jle7Ojw6KkAi1fxO2zb1BWRtir3BecJhmTSHBAdGRLVikHr4C5c/:3HbY4jle72PKhi5fdii7BecJhmGhAdGU
False
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.60 KB MD5: 89d89476ac2c03bfcc143c05b1f1f614
SHA1: 598dc6d01d49a4f920f66b55ef42a27a14618ded
SHA256: 8969e061903b17bcc3ad0f280f5505232207a8f970799a7fb6b9b79462a2b022
SSDeep: 48:ogKV1OyAu5gVDjtLvBuRN+9fFZ0k1eHYcD:hKVgTBVDjxpcOfr0IcD
False
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.54 KB MD5: 509a6d5e0dcb6cad9a2e31dc8d60fdf2
SHA1: 6d9d901f0e39c87202d10bfb57c34e7bde0a2b2b
SHA256: 0d9768157381f427993c5f7fdf645e1c7654e5a067a819c3ef1a98d79aca3e42
SSDeep: 48:4kHArXGBWL40vYyHLWhd7J5yGlHMyjKvuhwDYndx+dttWc/:PAjGB2XvYGWL1BlHZKInd0dtsc/
False
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.04 KB MD5: 78fadb9da18da398b4d372b9d1eb75d9
SHA1: dbf455987d8a0c7c4892cdfab58bd875cff2e0ba
SHA256: 781c473233671b1e183f77ee236a19c7379b08184f069060ebfd495c75142d30
SSDeep: 48:R4MZmItAvddVHc6ROLlV6MwV5n+bWTNc/:R7Zw35zRIwx+bW5c/
False
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 9.51 KB MD5: bbea6a6ec29a13e9de5ba1a2afe456dd
SHA1: 5ac4fa7d32ea229357a59b958dc20bc88318b2f2
SHA256: 2456f3058f98d7ab5049c624632db14ebae59e491b5fafd7a8f1af3f61809095
SSDeep: 192:y4hg16augT7e/qJsvYWZ+v4NHjmyVZ7vJhhUfL4e6uAXIPyCctiVcR:yrLT7eqRw+wNDV3hhkL4CaCYR
False
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.07 KB MD5: 40d0108ad15fe1981ae71f699ef24ecf
SHA1: fdf50d77129cde7db49505694e8ef21214d059bd
SHA256: d9ae2d5c093b95db949af6d81223c908e91a520fb42ee533f95e50e146f40487
SSDeep: 48:UOUZK8hSa6y6PHZkBqVMBGHT2srrmGh5a9Nc/:IHoy6/ZkaMBGHxWQY9Nc/
False
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 3.14 MB MD5: f0c0c342f83e0b0509a09530ba1daa2e
SHA1: 37ae2397401425579ddc7e2f39316ef9873dc1cb
SHA256: 3ee33fc2c4e29b00cfc2078ab92992882f9adb137e9dcafeb62ae7f194bcc4a8
SSDeep: 49152:zDxL8QBo0Tex4S120ytJybwjKehJ62ilFotoHqSATH:zR89t1/eNUFotCAL
False
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.81 KB MD5: 7da6eceae572a724860687905c281e92
SHA1: 09fb9423a13406a9313fea45faadbb3badf6d5b8
SHA256: 6724f4fbfbe2e8aa816c7d1577bc73829f13dc0efcef8c751ade823ff2155e30
SSDeep: 48:SvyXDHewjV5hV5a5Pa4YKSYm+Fbltam1aleLc9:SvqXlSPXSYmxm48c9
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 5.67 KB MD5: 194e74a87c6a2de38106e05501111f26
SHA1: 4048dda3722ed35f7be338eb6e70bae2c15a724e
SHA256: 57dc07c8da3aac8427579541bc74e9a3caafbe4c41fbd8858853ba046a0c19cc
SSDeep: 96:XzV7eG0I/FAHsia0nMwfQNvoNhleLMlJVes2iFMudtuwmxorVcn:BKoiaIpfQNvgiMlve3iC+udxorVcn
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.05 KB MD5: df1b8e6bf61a226877f3970fd927e763
SHA1: bcabf9fc96ac2e9e1924912831355846946d5dbb
SHA256: 07145689a1f9302d9178d1dcfe265d7f7c09339a80fc95c31578420d519bdb06
SSDeep: 24:rijv/pYAznbev95u+9bFwBf8vyFO7MUqt1cRWW8S2htVcZ:rOtzny95u+9eBfYyFH5iKS2RcZ
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decryptoperator@qq.com].cry 26.79 KB MD5: 5912665f096156ff658a137a5020cc71
SHA1: 98824bc021d8e1f2b3d5cb1d46c98fbee279b14a
SHA256: f39739b80e5c29b53cbea2c8a91d8e082faca6d5033c13fae636897f922fa647
SSDeep: 768:T2L3oVkt/WvidCB3H18/5Qmnhoz9sA5TTfhffvsFfV:TwoVkNWpZH1xqo75PVsFV
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decryptoperator@qq.com].cry 65.85 KB MD5: 03bfd0362ba038860caaf99095d9b23f
SHA1: 061d40feca5dcfed3a2a4adb9e66fe282add69fe
SHA256: bbc4748a51d7b8710a1d2e094eaff783a5e18ab8b7fd853f66251b7833049b64
SSDeep: 1536:CV0+SmObkBBDxHSU2RUR1E62tKXhvNPopVsmIQ/:w0AOYBFxf201P28hvNTmB/
False
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 6.33 KB MD5: 94eed9d607c6a08d37d1d23d7e10deb2
SHA1: 70ec870f77f457f48f2a216679500d07f6a41a83
SHA256: 1852048001cf6b3f829e441dd80818b43c75cbd4b337704d6b02f101c1be4ddc
SSDeep: 192:TE72zGKAOM/EiwQhy2F2tgiGSnhKBuJi6rv9c/:TE7k4ZqQQ28tnNnhyugkW/
False
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.65 KB MD5: 44c83eb63be8b50f69e009cdce125883
SHA1: 636e90146155120e85f07f3d9f8522be3a5807a8
SHA256: 63f9b63fdebaa31382b5ae0be176457754eba8c42f474a898a9538c425f1e4c1
SSDeep: 24:JGTg555mLZ3HvMzLfYpYOPOdCUhaU7FmtZnPd/Lx9849ThxYtET41LiRtVc/:4TgpAXozn7edjLV9ThxYw4sBc/
False
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.56 KB MD5: 83537c74a03b364b6d52e19ee06ef1be
SHA1: 7cbf41dde8ddf477265f9d6e7928cefc032968bb
SHA256: c655ec5d0a4e5f1469dafe3a4f95a14b962501bacfe32ad3081242fc821d1ecd
SSDeep: 48:SCPokPCb+GPhb4SmtG0lz04211z8/eOcn:jwgCb+Ab4SIA1xmcn
False
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 2.80 KB MD5: 4de0df57143fa1e4881c65611ddeb5e2
SHA1: b94d9cafcd03a6bd6d1dc63fafd361b8bc5a93be
SHA256: e8667bd6beabed4fc213b3480910f0d9bd4aefb59517cbd61028a5eeaa69cc77
SSDeep: 48:UwuiVFwV9lieH/O9067hAJZ+SEptK8MkfbqO1pUPfwjPNglJNzxt2w1CKD6zn7pF:7u39PHb67hObE/TMkfbJpUH/Rxt2wVML
False
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry 1.05 KB MD5: 52f080662aa5b42476367a92d761584c
SHA1: 54f16c974b66e6ebf3bcf626ea2efd44f0b0671d
SHA256: c7a77aa98791c36ca3f77eb71c122a33be99b92c65e9d8cb5f0ed1fc1e19a274
SSDeep: 24:guehdrMK2YYsonNnjut6ZjObCeL4MIJQDpwEtGOjlw8PM/SWS2O6tVcZ:hUuK2YYsonlfi4Mb1walnMc2OicZ
False
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry 582.61 KB MD5: 81d0e9fb5933e9563ad9b8db1a8340ee
SHA1: 375474ceb68d17391702ba2f03aee75b4c61b851
SHA256: b802091fc517640b8bee5ff82d0b9df6beba9113002cbeded700958dae3a5b1d
SSDeep: 12288:Sa5JVH44EB5CUiQLvx+a/m3alfddSgbwmCtywQD1OCKxP:NXYD5CUfL9/m3kfKaqtnLxP
False
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry 4.42 KB MD5: bf90d6ab6c232ec26e1e6a296c53551b
SHA1: 20438b0a525f7475c8721abd742a971b14d3891f
SHA256: 827cd527e5ff8778fb02fce5ac276e6939d1e5204ee24975043c2cd49b48d9a7
SSDeep: 96:XfMkTB2F+wgM6KdMfDW77I+kL6Lktsc0VTl+Rfc9:XfngwwDRneOmJGlgfc9
False
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry 6.51 KB MD5: ef88b32a2de581062855febead3807a2
SHA1: 8dbbed6c240a305b48bffbb631a726af70add2cd
SHA256: ae6818ed30f84601e6b3604c0bd3bc7c81d81edf337765c72f4785308f4e10d1
SSDeep: 192:6E3fssFjOz3ldsRS37wrjLY+OjOY26CdCekcEz5Ccn:6obFS13s/LYtyYQCHcQzn
False
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 3.14 MB MD5: b498b20f19b902dc41463842cfcc1d08
SHA1: 7dd7d383d5d708ff10534827bbc162f249bb38b9
SHA256: ea8263bba780d0ed2c5e5b7b3dd4cfce9c779b7a9a75c9b0232f0f6604e571c8
SSDeep: 49152:zDxL8QBo6Tex4S120ytJy0T1l1uIV8QSf9:zR89j1otDSl
False
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 16.52 KB MD5: 5ee82e7e1efa321a38e7207013f98c41
SHA1: 69b7293c74c455d7d0e9b9f5adf5f834d8eece08
SHA256: 0c1932484f4174ed5b71ae3d9e9be3028db5aab973d7710aa31e349cdbe4734a
SSDeep: 384:CsyWk3M8mnsPEJOwMBjqmj5rADy2ndzRAEUPXnvzRR/:CsyWaPEJObZC22ndR0zP/
False
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 67.85 MB MD5: 6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT
False
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry 4.42 KB MD5: 0542b767e8fe450683f30194dd8c2b87
SHA1: e8619c28bc1ffa38c8dc9cb643f7cc7dd87735eb
SHA256: 4670a331fdd0db6654c3e6f412a9da47f4f5922f59393edcdf2bd4b8f2f08461
SSDeep: 96:8hNOgiRc37Lh2M8EsUTw8GlXWc8aNoEXciuVXdcjF0Rjvcc9:8hNKR0dwd7NVutsc9
False
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry 4.42 KB MD5: 55b4620da8c292ce555b5a07d0144f26
SHA1: c3a15ccb005bdbdc50d0410d1e16e7181df68544
SHA256: 6bb67cd2684d79260d7a9de3eb420dcc7b877f011f4eaf37b87154ed177660b6
SSDeep: 96:AyiqbF7DgBnPQ271NXEwROpjwIVYV3tNfaPV4QWXjjveX1oitc9:AyLFgBn98waq3Ct8vuGkc9
False
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry 16.70 KB MD5: aa79e4bdb0c22a813e1385dfe9f06e27
SHA1: 860bc608a459b84684319baa72b721c2e20d302c
SHA256: 61e32f74e114cac594174643c7f92021ad975c14774c7ef50d51af301c8a4351
SSDeep: 384:zF1JJtd5COXOV8zX3qWWrBJhD0zqXc2lZln3ygURMdkv8+ZmlFLPGNCJiJJ9:zF1sO+CqWWrBJGzn2lLHSxEFakwH9
False
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry 30.60 KB MD5: 3920958d2d6e6d143bcee51472f273f3
SHA1: ad5adf2fcd61e45f4b1b7cb68587b373fdebb90f
SHA256: 46db404e1076811f601c92685cbdca4f0046ea8851588f36e729d944cdc96b23
SSDeep: 768:To2l7cbZW33SUpNRLxNy6qyl9tDpyeAF3+2xdbHKk1qK2/:To2l74Q3VpnLx1qyl7DFK3Duk1qJ/
False
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decryptoperator@qq.com].cry 8.76 KB MD5: 1c8b34cf8f9df2b1d427c466263e0f03
SHA1: 60841cdd70a83522b582946df06298a8f74d39fb
SHA256: 6e637b764d76947707a72d64e131c67af0726f66d41f524e4d02bd7b8412064f
SSDeep: 192:GKLbhkj7oy8dcHXfEDd9UwPi4a4Mm4xc+oh0UcR:GKb62cHXfEDDUwPa4kw0PR
False
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry 1.27 KB MD5: f350689d685a33247c8320508f7be884
SHA1: 4775f90bd0e24370e648f3768632595853ef625c
SHA256: 354cdb127d5e6aad71cec04d09471c291d6ca8cc115ef4a91e9bb88542d8967a
SSDeep: 24:vLcnTgAIZM74h/K0DqXEyqs1eHjr5iFpGlV9Vvw+r6JuoSQlJcsE62pNOAMZoxYq:Dc89ZMpsqRq4eDr5e6vw+r6JBlJzE8AV
False
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry 1.27 KB MD5: f1b57f995c4424290ddf75b62992805d
SHA1: e94a03f9d7f973859b7ef5ef088dbc11d4cde537
SHA256: 258c60ce28f7018275377b12174c4f2d7e897cd1eb524dd0345dd21e4ce2eb92
SSDeep: 24:DZiO23vaSOLC61Bvp5Ud9q72DN0/22BVHBr2fxaMgzpDp3hCe4IJ2xdCStVcN:oO23SxC+7Ud9q7eW2QkxECe4RcN
False
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry 1.88 KB MD5: aff5e47f4704a95a807b1b59992c665f
SHA1: b32074a86f2210fa752e9f84e6866f19aac6b503
SHA256: babb84d852dcb1169d9705bfd4811f38e883cb582229e01770075b5aa294fef4
SSDeep: 48:qMY2Fbnnqe21xikWaF3pu3iE+WDIdUQa3MaHzKkkacN:JY2FmrxL6thL3MEYacN
False
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 3.15 MB MD5: 09e81942f4a0ce36d9eca8c06a3c01e1
SHA1: e5b4bb6798a6b3b23479516ed3b7ad9e9731af4a
SHA256: 1470c545ebe2d249a77c961e602916cf259822018e21783d60f807640928ff7f
SSDeep: 49152:zDxL8QBonTex4S120ytJyQltgxV0pp6uavJzAjWpr:zR89K1A6xGpMDvJz6Wpr
False
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 10.25 MB MD5: 84b60cdb20431c41f05666896bec6899
SHA1: d3ba9e55dc0d1fe5bc78138b66e255294be1a09a
SHA256: b70c7e4e96dfa72f6c72ba65aecf6d4696e2c3425c885ad369c1ee329482e883
SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+k0Pl:MUvTiNhU4L7tZiTnprP0txRsn
False
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 14.88 MB MD5: 0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35
SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ
False
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 42.53 MB MD5: 4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj
False
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 3.48 MB MD5: ebc60c4db49a7b84dad9d7da2edfd213
SHA1: c5e35fed004d5236060f7021237a8bee0638b1f7
SHA256: 34f4900e7ae4e78cef36a660c74f39819ea4ee151c07964fd20f96260998799e
SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6LWu/zi65f/rGpfxQ7cYM:fqLVW6v3XziYf/apZQXM
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry 2.35 MB MD5: 69902d844f1d5ea495c13a8a0f5c8abd
SHA1: 2bb92fce2d64f4818ef050283320d8fc386a1178
SHA256: 7f911af1adc9da79ecb03d555695e62cb00e480259cdcea220a3acaae3fe99a2
SSDeep: 24576:nzyc0opacbhmgk5gHL7a35AyjQgz9vzBA4rdeNkzfaZjBde5iPfsVOoejlwJf0x6:R0opH/cgHa3HRxz+4gUiZ9p2Oz5ouxUn
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry 2.13 KB MD5: c13b9535dcf903ff531340a38408a996
SHA1: 8aad78365d0a62fb34ee37530d5208fd6b9fc4e1
SHA256: 4ddf505ea8a6ef0cbe45e87dc2f6ada3bb0041df297c736c9fa2c5896eafae9d
SSDeep: 48:M9jor0rDG47Or4X5Mpr+j+m59/0Tc22PL+jT5aP4gcV:qUr0/G47+r+jn59/0Tc22PLE57gcV
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.80 KB MD5: 8a1cdb731239e65c8137e4e5db5c5b86
SHA1: 4e52488531930e3b33f0360b9e6e68dcee1afb82
SHA256: d00e787ef2b87333bc967b83dd5fbf4d0907d7e0eec701307546e8e6fe8bc709
SSDeep: 48:34K5sab/ERHvz5SQhQvVGhDk0MV716sDgSRytoiGTRpuiuCQyR4c/:IKSarAHvzgVvobKXTvDQyR4c/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.05 KB MD5: 19c5eb66d7372788a5556906271de404
SHA1: 9cbe343ca7dcfa286409593ade21c2ab72e8a06f
SHA256: def7e88012d67482f11c244b5fa5350910bc9aaac2bfa01250b362834f6c05e7
SSDeep: 24:AikwYgcenMbl72dqZpSgiCijFUX/kB2lVnMOD6jFWS2ANXUtVcZ:RkwxnM16qZo7UbmjP2ANXscZ
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.76 KB MD5: d3760d61850a4a9c125dec22a2b59f80
SHA1: 0d885541ba76f539d64e9f009321e98341cf9ab0
SHA256: f305f9877c9db45fb30bfe2d1eb825b4365044c07dd556b5a381cbf545e4686a
SSDeep: 24:yL+gqVZ+zd9Q0ntoM22JnLibfQkFkntwhmDcvUopAHXAuOXiZgNsY+9D70Av/dkM:RA2jQnL4onyQ4v5m3hOXwlJ70Av/d8cR
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.14 KB MD5: 6331e12d82cc0e59b543ccf271549f28
SHA1: 464334f7248aad0a2496d05d27b61b46b7a76fd2
SHA256: 381270de72ec23ffba3c96c5e7096a0cdcca90d8e1e448f68560a8bf0dd9010b
SSDeep: 24:vPRgOwoGN1eIn7hIOdhdrMIjOzAEyNljblI43N3XgtVcn:vpTjGZtrMIjOzAhNtblIORIcn
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.65 KB MD5: 1a06446ef88c17abc4dd36579c45856f
SHA1: 0725f74007ea5f091f1ab37c0839e89a9a084a5b
SHA256: be096467a69044f2a42e215df370e1603272095b449f7dd5d7cb1dc278c3409a
SSDeep: 48:WawoAwsp1StJ3L9zZGQLuvnjtedNmfG8wc/:Waw7wspEJ79hLuvnhwc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.47 KB MD5: 1cfab2c2636ca7b4c800e5d7d50dc728
SHA1: 0d83d37bafb9f2f8c71f53e988d1f28aacd16cd9
SHA256: c690af472cb6d721903b95ba77fcdd52b4c0c33ca7857866be95917978749a12
SSDeep: 48:aSRRwRjeivRRsVTQpo9eEgHANHe6m9y3qCMMsEE8hFXZwz+BwodjpWKgmc/:1w6aRSTMo9eEgHZ6e+5NFhvBvj0Kgmc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.44 KB MD5: 3f86cd37adfea6d4da7c3ec682426c60
SHA1: 09719fef77e0a9dce95b30dc025fd278538a0d61
SHA256: d1d5f019021a66b40def1540ba278ba662dd372b5ede5da15f1899d22365642a
SSDeep: 24:KtfWPQDTY6QuKztNQxbGP3bGkIaClpmsfaMGdrAT4z/FVKJ1eWpFT3btVcD:KtmQXOu6OxSzsaClpN4u4zETcD
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry 69.80 KB MD5: 207e894c1617d9515e64763562f678d8
SHA1: 5460594594cc2ee7eac2863fe3403fecd92aedef
SHA256: 203a630070a7121aa6ea0a0afb691f0eefda565113030c69d183905d5e7efc60
SSDeep: 1536:vpSnTk/zaYFmWbY0lKrapwtYyPh3Aj4Z2NXxr1SWZu11G/BT:vEnTCWm1MQK+p+h3AUgNVUWZu1EBT
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 5.67 KB MD5: ea76142c868055278abd99ae6ef859d8
SHA1: ce7ce9824850ee08f9327659a52ef24f09e97c8f
SHA256: 085c7657d8fd215945ce11223fccc79f39ea9840c1c32fbcee038e52e02c40bd
SSDeep: 96:XcE6a7pPtVw9/gzHZ0+FQyB/PSuwq0FRbPsGh2krhhzWOhTrqDZrtua6VSMJk91z:XtP769/d+t6uuzh2cz7hT+1MaISm4e3+
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.05 KB MD5: 0af7af35e6eebba4e7c80e0b167bace0
SHA1: 4dad35a786c168672b82675542f5d794726740e8
SHA256: f9b078701b19c1040b08b8b747042eb02ca5aa9140598d72e667ce81595e7c4a
SSDeep: 24:kZqWVYe4ctIkCp0guAoToIqti/YytOZTW5MUtmMx99S2zhtVcZ:A4eTEp0guAgrOQ5tf5S2zRcZ
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry 26.54 KB MD5: ca4b82360e39f86861b37ee41409a6c1
SHA1: 53f52e58e27759aff4e9d9f184ef10f9006d56a4
SHA256: 74ed18a3e13358bc031e29384b62c9c503b2d2346a9c523d5d95a0dfb0b735e2
SSDeep: 768:oCGKkF58L7nkPvC5PwhkdQNjiBsteUXNsAFJVV:0F5bPvcDGSFcV
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry 37.04 KB MD5: b711ab63ee2c252419b719b405386fd6
SHA1: 2535f3c0947af7dc935b2493ae56be286424bcd2
SHA256: 8475ed5250cf406117ec003e5b452c019676bbb9e05560768a6612da8f852691
SSDeep: 768:5qbyWS53awO07Dob0kwfh+faEtTSBgG9pmPfFXl7V1C/KaR:5qGWS5ApI0fa6TukFV7VRaR
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry 26.79 KB MD5: a1b61d50e70b6479e364722465e0706c
SHA1: d4910d8f2344e9b31f3cfbabf40fa891901614e9
SHA256: 7b697384d5004eb53bdb1cbdd6b6e9bf1581eaa7dee11f4d919d161459f5dfd4
SSDeep: 768:fuKumz4huydl8IX8AQQCscjs4Jzp8mudwV:fuyz6uNIX87Fbs4NymueV
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 9.37 KB MD5: e48150c11973c885d6c959fe869f0e7d
SHA1: e893b60d38932e4647448800599ae4774243f5ac
SHA256: d8091bb768d8a8ee7043eb51a8a5cf98ff55a4cc81231b9415499ae446310efd
SSDeep: 192:lMo9PU0boJkeTNVwxDshS+bnlWi6PNutiSPQ+EzzrL8tOOHmc/:NUjDVwx7kZ6lutiuh0zbON/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.54 KB MD5: 3552bb186963e9a1db4f63b3353d5a63
SHA1: 069382125e081486cf21fbb3dc806c3a67386335
SHA256: 0a9a555645db21db83cdd064f9eb1906a3e4dea458086075d013bbf3fb2affa4
SSDeep: 48:JiB1XEoK3ju/hig8JnS8YPYzo5qvBsGCjGEKCfBtrUzSjEPcHXawqj5rFq8jc/:0zXEPzLN1S8Ygzgq5hFDujV3aPfq8jc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry 4.42 KB MD5: 8cda8f5faf6d24140dbb5a6ee1864211
SHA1: 19d8d772cfd3694b3ecd105aff7f2f27420005e5
SHA256: 31a8efd08c79b52f691186e5b40cab40f33c442145103bed5e73d8fbb5fdb6df
SSDeep: 96:RZj6bqN3p8Mq/vBMTToEPrpHGbw9gtaxnA3lAznqL6X6YyfHc9:RZj6m1uL0MElgw9gQxnA3yzqL6JyfHc9
False
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 3.16 MB MD5: 0878d1e108f93a14e8831dff943af1d8
SHA1: 504a47951bbf3300d3363b529372ca38715625f6
SHA256: 1a8ab2c5e66fd3d4a17a5cddbc124eda83d9133c1ac10acf69a6c56b924f2a28
SSDeep: 24576:zxnP6WBzkm83xgDBo8o93HeJP9VB5bxQrzVDFJdjHs5wuofLfdky20ytJytLmB0X:zDxL8QBoSTex4S120ytJyt+yo3TjoLIQ
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry 65.85 KB MD5: bdc241afc790c806735304a627dabdcb
SHA1: 2d1d853590ac88b7f04d858518ca6816cfb6a60b
SHA256: 8642a6a90e809e32602b06bb13fda0e873a71eab7b4409603cf134a5d1c2581e
SSDeep: 1536:XWnzSc2NEhBkgox/rfcG0ZCxzauowp0PpfiSiod+Ivi6751/:YSc2NE0goxjr0ZS1pqpqTod+ITL/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.04 KB MD5: 8d0851e746e855726a9201af35756311
SHA1: 7200399ab39e338b00e1eef4f4cdbcfb6d7ee890
SHA256: ceb220497825516bc53e19af199b2a56446922e7f0671d8d04841a779b7972b3
SSDeep: 48:ql3xVXEaR+vOYtZwqXLIuS/HSeyJdE6MQlwFMpKc/:A1QlLIuSHSPTpWqYc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 31021b3d70e5fe07e2908e479e6fae7d
SHA1: e2d02200b267837c94521a5d1b463b044233dc47
SHA256: 7efeaff35c41d660def591913033e0c8cdd00a6780b0228727fdabf5e687ae14
SSDeep: 48:WyysQEDOEFECEYlMZnIISWUEJIQkYRy4dtjUcv:iCEYlMmxzUMYRNocv
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 4.33 KB MD5: 79b66f0262f6aef34574ea34d5d7018b
SHA1: 67b2d26eef6dda3b7a6015dabdddfdeb576ba9ea
SHA256: 0e25d3ce9285f4f62c0a4bfc5b4360a7c6f374e78c812c36e092ba9029a47f6c
SSDeep: 96:xLBQJjwVWilf+SZMeZaF0uCu7Gn9WxLAMpo/Tc/:xNQJjEfx+qMeluCuasTSLc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.07 KB MD5: 0abf47dd866a88fc3f31f42dc37080e2
SHA1: 925a877b0180f6aa8d29c185cc9569380c95d905
SHA256: 8506c4b79e35e0963a80df7d124a866746a09c9e4105edd48e830ca814ad066e
SSDeep: 48:LC14ceOcEHjJiIVuvQVA1PtERhvQOaXYtGRnunOR7wCKNoVc/:O14cFcE9BV5DQV8OnMOyCKNoVc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry 6.51 KB MD5: 94d0a59f1344802ded0beaf648e11e90
SHA1: 968726de7f52a2d8cf339e03d4b15ff8d948328d
SHA256: 320ab524ded7d2725cab5c13026c1357397d6f9a51e4b08b0212891218a993ef
SSDeep: 192:La01+Ii/IpeP+wL3QorhxoV4AY5B1osvy1oaaNyThJWcn:L3bipP/zNoVZaBneRhbn
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 16.52 KB MD5: f9c097257e364e9b817d69906959d963
SHA1: 252b1e266a2c92d00370c3ce9e46803e1a006764
SHA256: 902063b472f9c152bbb26ea42a23a73abb266c5cb99cd0928eb438ebaca0e1fc
SSDeep: 384:MrNjE3oe3g5UtN522i/kBGmSijGR3tmnnw34Bfpwc/:MrW3Y5UtN5nU0Gmw4BRwc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: b4fedd797f34502a73049c1a5b738a7b
SHA1: 76afc250af91e02b33d7391ebbed2422c50c5225
SHA256: 0e85438f209d3c191ef2018285b606cf390aa6bb6ecd852c304fb5072ffb9e8e
SSDeep: 24:2gWsC1ItlY0ZqI0AFeSOkvCkT2ifD8ZxlrCFVqZxF87j1ciuoGCV8Z3uZc5ltVc9:QR+tleALLT2irU3qgOxGCV8kZc5Fc9
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.81 KB MD5: 452caf9394d385bd5e99995985864ffb
SHA1: db595f451c73210b62553763404ecbb3bbde583a
SHA256: f23b93c79cb393a2a1d39667091cf51fa9a7498b55bfaaf7061b3e9d87c23d0b
SSDeep: 24:fR1XMSZ88agPSo4JEppsMhD2z5fWFyFa2C+ffFCAbxN830c71UM2jpMz+07/FlK4:vXpPhGEpp6V+MJ1E3vKM2q+UFcupD+c9
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 992a2a574f7b6b1491c13ac7de082d88
SHA1: 1147dc80a8dd3019b34bf6568ad77e0a8e92e36e
SHA256: a5868b8a7caf7c00c13d7c9037a33a9fc35e967cde46015f4205b274824ab55f
SSDeep: 24:WHg7DYzfFp15IuKyRn8qK2nN8/xihryH631cEmsXqlqpf/GEd3rOsd0QAQ+ftVc/:jfYzfFi+1N8JADbmsmqlGEVrOss1c/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.18 KB MD5: 3316833d982aeaa2442811ef21ab76b1
SHA1: d7d0adade04fada6a73eb5c5c8510f9f0aa06c11
SHA256: 70e873d84f53d2aacc158cb0a4e123b53650d9673b189592aa0a38edae26bd98
SSDeep: 48:3/bXjq0u8nXts8f/C+XbIUSmpWcrXqOIELYpGFc/:3Lg89s4C+rV0oXqOIELZFc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 64cf47f9b5910e09dac99127b8c3ec9c
SHA1: 27cdfef6b0ee5781ee96e51c9393dbc020805442
SHA256: dce3de0ec318e4bf52a0df91e1c0108ea7286691d5c6e0c0d73ac528621e5924
SSDeep: 48:XKCIOtAlJVBuha4lCYb8WgLieRl+C5G8ALlEsmYc/:jOVCZd712+UZALlEQc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.07 KB MD5: e2ffa35ef38e0a738326a0856739a679
SHA1: c1498e9491c571cf896221b5526ce8f91ffa0616
SHA256: f05bd282dacb8175f4891a92a64f2603d13f8d33b340576909f393758e699207
SSDeep: 48:OmLidRw7DUzXj1kOjT0nD9JCH+obS314zMTlS8//uUM4e8c/:LLisHAja5D9JCH924wTlzu54e8c/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.55 KB MD5: be5eb3d61d93aa74177aed4f1936e23d
SHA1: 4be550919457fa5f60ab7c3a1699220616c698bb
SHA256: 39059acf1502ba8a601b6e5f54f9df960483eb2cdf12cad174ae2c1f045afdf4
SSDeep: 48:Ms6jTI6bQQLNjwcQF1ovrCvYgLcNa/uvwHfGzu8sc/:AjXb/L6cy1kgLN2vw/GzOc/
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry 855.24 KB MD5: ab24ffaf83f089260f861119e7447467
SHA1: 4664ad18cb6876e7e14538f001fd9efbfda78414
SHA256: 5ffa23802eb2625d68b2f46a88985112fe0d62cefac31d72c1599a6e3e8c4b8f
SSDeep: 24576:P0lJ7q2//mGCRzrhpkVAGUGpYGUoWojltTNE:P0lJ53ORiRU3GU8te
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.03 KB MD5: 5bb99e25fb356414128bd88ede809c97
SHA1: 2f68996963223b1b69c8ba858b327e49956e2583
SHA256: e4f462f26ae004961629366fba1f4ea706dd7f4b2521c0271d9dfd7e3f6c5e2a
SSDeep: 24:bODB7ZUdMMecey7XyuB+0yfGSTcfRw/tVcTt:b0BNfXuBRSTI0cR
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry 13.76 MB MD5: 42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163
SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455
SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.66 KB MD5: 79ed19269358e5410408f4d942ccdfe3
SHA1: c3c818fcf97824b8b75b579e17da956e37c17cdd
SHA256: 02705c260199dc317b52ca70915a62bae45e4d63d6ff3694be222bbe717ec8d0
SSDeep: 24:k/0xC+OVt6dSdIy2ghJaNcVfuUhbIoohl6WCGFXKlZ5rOgqYFotU0ynpzZIollsz:lC+Oj6Hy2ghUc1kJyqYFot04jpccZ
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 6.33 KB MD5: be2f61bb6b495d84cd6cccc0ffef2499
SHA1: d1779b847fa6c6cc7e119914977a127b799ebdfe
SHA256: 2e1f641ccfdd6f0e431eb085c18938127684d4c8b670c161e12f59c6ce7b7601
SSDeep: 192:w6s4J0GtinjaZjWHF2hYjWLfw6pNlLPfrc/:xsWLkjaZRCWLfjHfQ/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 9.51 KB MD5: 0ea65d9e635b23008a67fa298d581396
SHA1: 6ffe61fcad87164404405ddf3c14a297dcff16a3
SHA256: b56720aab6d82bd5d17eb385e50cdf8ae4a0241058f950156d838e760f93d3a6
SSDeep: 192:4uaObpZMNC4NOHr2JbkCp2KKp8v6FqRD6pVy8yEAywI9FfKzuMKjRHHcR:4uaimCwYrhd8v6kKVXyEALtuMK98R
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 20.33 KB MD5: 949d367abc06ed742274431d0d2b1de3
SHA1: 559251c001fe02b0aeeff1a89a54b7f9a257ab28
SHA256: 23ca24a2b4518cab59c89528507196a20846d94a23108f29325ec07e6bf7b798
SSDeep: 384:6ru9zUPcgZTPJ63VBiHbhRF0iRB6H/cD9Ty3BIvMYXNTz8tvRw1KDVZ8SSU/:T3ETx0AbhR+OG3BIvVwi6B/
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry 860.74 KB MD5: be2b5646cf2536c1484c407e2f27227c
SHA1: 9bde3e16751bf85e2352cd65456389399bcd4051
SHA256: ae15f70e2ef202b6c3a02d945598167781dddc762ac3ec67e54eca46ef1a09ec
SSDeep: 24576:YWJIdE4BNi0KPWJ4kDHpgJe3Hrn+K2+q2zGwGiRNo:JJSJHi0O44ktCQn+uqYGwbm
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.80 KB MD5: 9fede4fc96d79f71d9dbe917984acd2a
SHA1: b67be3f93bff5a8a8f2d4ed8817f39112be027f4
SHA256: 4eef97e033d1419b0053f662aeebc98990f4a1f4926b1070b6892e03229c1bed
SSDeep: 24:O+tcrgElBTwzd9p/zxcr0V2DTvvMrP4dlUdlW1O5umAvjwqS+jUB+86gYyVSpft8:Vc84spL/zOr0QD7MSyxumAPOQbXc/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.60 KB MD5: 65ac4562333712508fa94f0f7f0d162c
SHA1: c082dd32cb99ea5765c0c51c18f8928e27f02f0d
SHA256: aa77ccb190749f33172d430941671448f787881c75d933e06a70c1863e0078d5
SSDeep: 48:Yt4C7myadiZ4BQGvPIzZjYNr3ptzdRMgAK6rc+QtllgYhdec/:IVCtd5wzZAr3pJdRMfRAkgdec/
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry 1.99 KB MD5: 12c6fcc261d984b487461cfd79fb6a6f
SHA1: c3fb26e0dcfc6336ea926f838da55093898d7731
SHA256: 4030f3f7e4f309c3663a2e082607208d0739741174586d40d3137266a9b7ce37
SSDeep: 48:HCo025ZP0rWxAHXrQC0UN914hyZOIIoc7:v0YZP0rkA3rQsNHBZtc7
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry 8.76 KB MD5: 92d232900f65bb61d5dfd673cdbc1be2
SHA1: 2222533782516f3a55e9cfe45fe9af743a29a65b
SHA256: eb154475bc47135df30ff30c0b15a977a1850c7e7c496eaf42b6369e65019e92
SSDeep: 192:hBcS4y+YdwMbajLVOqUHXQ6RegjH8fvtdC/POu/cR:hBL4yHGMbajLVOqU3vRfjcXtdCfER
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry 11.70 MB MD5: 052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d
SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021
SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry 11.43 KB MD5: 7f3b4316e2f9da03f63c5083f9d80a64
SHA1: 278b84760a85f79b5e2f003054f48f25c2fc70ce
SHA256: 0e0c0a11d3258218ceddb1ebe2ba724f785975689f1cd9b622ef1fc8bc25fb41
SSDeep: 192:gJwdDU6SDvnpgU1O+jMtTfGL2u7irTqsp4QlaqqZYsVI+6zal6FDZiusnsPSiGxz:gWdDU6SLpgU14eyzqQ4QlaqqCsVI+q6P
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry 16.70 KB MD5: 421ddf7a2881eb649ccb782744c95971
SHA1: 35920c8987bf62eddcf4a3bb9f82093c2a1b8a11
SHA256: 296d9cb50dc33c7354f0b046fcd7379ac9148fc979d4d42daad6899da1d1f46b
SSDeep: 384:OwVWNRXOgVfkDz3cKd/EZWpWsDUQ4SF82y+I6FoLcfEbSLFeQ9:Ow0fllkzMC/E8MK8LSWIEuBR9
False
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry 30.60 KB MD5: dae66c3b7dcd21ac51a8dee7f4601b31
SHA1: 7eef1f3c23e6b49b2412d82843a1e9cd9fd09a04
SHA256: c09648b74cdc5130cea6e530a9914300bfe49df52e35b41a70e0926883c1207b
SSDeep: 768:UaOj0VTYQkV/ct88lztfxL3/U5vcMpmD7Tl+VjXk1/:tOj0VTJkVE7/xb85vcMa7hSXk1/
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry 2.04 KB MD5: 73ce4b1cc0967cfd97f86722174c0b4a
SHA1: c7bbd2959339ef6ea8bd4864cc24843ac08fc589
SHA256: 6aae85d49501bc1a2bcbf7d4a69371fd15f6ee37b4423fe737872400b8a69301
SSDeep: 48:Q1Ll0Si7hKs+Xo88fI8o7XRugLyq2oOlL6dyNmTujc/:Q8x8IKR5ahluQjc/
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry 8.60 KB MD5: 344c53e507381ccedf676c3d948194ca
SHA1: fd86a231c688ef84414f1a9f8c67c5b368ac9319
SHA256: 43275b81c4835ae4ea80791dda786a63fb0d22d67f370c3d2982819f8f5c6af7
SSDeep: 192:udW/uaJkoIAMmMaaW14eC/eqK5kEOsLsjGk04ZOXVEGz7nots7LPaxAJK+vYHb6f:uU/wnAMmgeSKu7sYD04U/zsePP8AE+Ye
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry 222.21 KB MD5: 7e0c852430a2bf70d25030839ede90a7
SHA1: 3e3f5187aac640de592b42f8b67eb554b923df70
SHA256: 66ac8cf24602ba3ca86ceab1f5f61cc37625afe6f65a2e658168708a80cc4f8a
SSDeep: 6144:zQXTi7IE70jNoV4ttS3fRMgGuHIB16aH0k:Gu7IYLVatS35MgjHsb
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry 20.84 MB MD5: 3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0
SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f
SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS
False
C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry 890 bytes MD5: 65b923effa2fca1d5b71abd9b7bdba5c
SHA1: 9ea56cd5b1c95de7ba68d97fe8099f94ecf47096
SHA256: f4389f1a4d6a52791eb2cad56f44e0e0a5f1bebfe1e312143e008de167d0727f
SSDeep: 24:CKOiAiKnfK7lTwxGsAiKqHnM2mHkwqG0HtVc7:CpXiyy7lMYhjqHnMbEwqGuc7
False
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decryptoperator@qq.com].cry 848.75 KB MD5: 117ce9be2084cdf4de7a90c665b610f0
SHA1: 1747c7c2857dc2631a834a65e5997b20d2343841
SHA256: ac4e8c73c65ce188ac09715a735f04f565d2ca3819df911fa6cc59c574084ab7
SSDeep: 24576:jIfJQdG5nUrc0zrwZ/PPdkRcImmG0gP3Djbqx:0BQp6/PFygP3v+x
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry 38.34 KB MD5: d71f29a920dde31d1e49b48dac230c0b
SHA1: 83f75bf87817bd2afd7a98ef2e3401003e2e3193
SHA256: 398d5de967df2a3c3dd348a6705e4d5bd57f2c827f8934f38785fffba6e1d2da
SSDeep: 768:UIy5L6BOpfuVsyU5t0pDbtocCUpUhYSdL5Qd2/ntoK+crqW5n6uI2df0lNUV:qL6EK25t0scVQ5Yc+K+cOmn1I2doOV
False
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decryptoperator@qq.com].cry 853.75 KB MD5: 4d4c0625a337e0ddedfc767dc86468d1
SHA1: 727c6ecddd39ef4477fd5fbc9b17bb5613b3e8d7
SHA256: 492175950be0aeb7da9ad59213c49f0cd929d45edec143d915fb8758e82ae08f
SSDeep: 24576:NXEqnhYJSsYMnHPEETl51zZB8nGDWlHYrBNo2hQ:6q+JSsHHdzcnde9NJC
False
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry 1.13 MB MD5: 990f5e4154075f685212e2427f04ac65
SHA1: 00aae015306f878143d85436db69cb7a97b72974
SHA256: e834de2005ebae093b579341e517f88a31d929557d55e428ce3c99167e39e9af
SSDeep: 24576:pf9rBGp2+bscA9Eq6r1G/ju0n8ccM6bG1WrevdHMaWr15F9jGHAnmcgW:rBabsX9EqE66vX7ev4r116oJgW
False
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decryptoperator@qq.com].cry 18.75 MB MD5: d0270fa686df7e1fbae95ad8489a5b5a
SHA1: 3d43a29d7087167d3f8e12ec237a8b25599cca07
SHA256: 677ba720e203d1ce322f4a4d6e6e9933c277afc51f1d336e6c7fdd7380a2c263
SSDeep: 98304:llyaDH9kcidg6C9NfjN0+inHftQADI0Ns:iaDH9F7/iHXDI2s
False
Host Behavior
File (4545)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe desired_access = GENERIC_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Services\verisign.bmp desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Services\verisign.bmp desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\System\ado\adovbs.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcjavas.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\ado\adovbs.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcvbs.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcvbs.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\msadc\adcjavas.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\desktop.ini desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveAnother.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveAnother.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\pagefile.sys desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE, GENERIC_READ True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[decryptoperator@qq.com].cry desired_access = GENERIC_WRITE True 1