cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe
Windows Exe (x86-32)
Created at 2019-05-16T14:45:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe
29664
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:23, Reason: Analysis Target |
| Unmonitor | End Time: 00:00:57, Reason: Self Terminated |
| Monitor Duration | 00:00:33 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9a8 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9AC
0x
9B0
0x
9BC
0x
9C0
0x
9C4
0x
9C8
0x
9CC
0x
9E8
0x
9EC
0x
9F0
0x
9F4
0x
9F8
0x
9FC
0x
A00
0x
A04
0x
A08
0x
A0C
0x
A34
0x
A44
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | 0x00400000 | 0x00418FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | 92.50 KB |
MD5:
1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17 SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9 SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.55 KB |
MD5:
53d0b079d6fce1269dc5fe9e75fc9c6f
SHA1: 7de7bc6ac065c5e320404310a184ca89a00d574e SHA256: bcc135bea8de1e66e2f2b6d01346c22966f2a047568688515f730c960d3544df SSDeep: 24:+gV+SQCROSO38gLVYFtl8/ezDUcWL6rs2UyXJDQvbo9TdEcZ8AwVEMmDI8qr6E+7:+ggSJwMgL+3Uf6reytIu9Zk9x4iNm6c/ |
|
|
| C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.44 KB |
MD5:
9207458f4cad805057cc8ca83b332cf0
SHA1: d5e2954af0b220600450377d7a893894e9ef321f SHA256: 1860491676ae364f8cdd5a50a5e6e6eabd6b3cdce435a456e586c3876f4a475b SSDeep: 24:OD5Ui0x9meoLUWX1n83zjVDNzDPwaOioApRbNwYdcd3Ez4Kmh+p2+zbOeLtVcD:OVUib9n8XVDNHPw/io+234DmQH2eDcD |
|
|
| C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
3c03ca759139818de3a4408c6ec39906
SHA1: 91b1c3dc3545b423e9b204f649ce31cc459192e6 SHA256: a3ce4e2daef7eb129d63e1d676ccac3bbd6467d0f4a4ea65ce9324fbab42501f SSDeep: 24:/ayI5RqsLHiQc4YL7W8ep81qh3Dtf6iVZZ2/0kSoeadrDi1As225emeAtVc9:9Q0um7W8e3DgeZA0kSoealius2set4c9 |
|
|
| C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.14 KB |
MD5:
cb0d32878116323a9887777fdbd55c91
SHA1: b2b09f6f440665e8e4fa7e3868e07edce391fd57 SHA256: a8a89f62d27e8bf8304b0e52603d4bf23c78bad825f68f92d8f3a7c67cb30720 SSDeep: 24:CBIqUlh2Jtpu4c2pTLTun2eUy+v2PsoWVYpeOotVcn:JqUgpuSP6n2eT+uPYce/cn |
|
|
| C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.18 KB |
MD5:
796b6f2ea699af44d325b663765d9841
SHA1: 72f99535c833aaac31dd4e81ad7435e3ff141f39 SHA256: 6e6b9e8794b3336504d88133a8656b68fd002943b7fbe80de654bee9c85c6c38 SSDeep: 48:5SiB4Yz4Zm0UQmsg5Ao4yfg6r+X5DWVEBcjrlZDadFhqY73li5c/:1OFPABGDWEBsrioY73li5c/ |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 9.37 KB |
MD5:
87e66004b0f5a8a6701823cba8b75155
SHA1: b3a1e53f99df175203eb7be62a93294ef4875bf0 SHA256: acb7a3e55fe8c3bb14dc1c7ceacabf43691f0a1a0e0d1dbef91062ae626103bb SSDeep: 192:UcgSyUJihlq+G30mtng7wB5LU2cRu1wjQJU9xjNz+BKfI5jc/:UcgUMhlqxLOJRuWjxJI5Y/ |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 16.94 MB |
MD5:
2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07 SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4 SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry | 582.61 KB |
MD5:
f8d876e8c600820cbe679b0eb3acd4cb
SHA1: d5df6c2702f344c233af38eed2454329748451ce SHA256: 6a82efa51e5037b79a5b5b89a56beb02e331ec87418029afa9f77f51f1cc1a03 SSDeep: 12288:D5rDMHQ0v5eDFM2jit+hRDh1BNeeeplr7fWoevXvP7:s58MQrhFDBNil3fWXr |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 20.33 KB |
MD5:
8254008843a6a323a17069d774783400
SHA1: 14e7a803ca7313614bb8ebf9caf46f40bdb8aec6 SHA256: 0e851ca644319797e3a5a3cfd53fa5bfed0f2bdb08ec07f7d149f8d58515ff77 SSDeep: 384:7himDuKyD8+mC2aUmPYgN7VpVxAtlgTqUmwXQExc7vcnujX80LDkuXBd1jnB/:1igLyfmC2OPYgVjfSlg4oJCzdkuXBd1x |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry | 14.94 KB |
MD5:
1d7317e6f50f1f0b2c4627bf8d6ed645
SHA1: c31634702383e524ab55d7efef4c613a397bcdce SHA256: fec6f8bc4d8e3ccb12011401805f2cd2dfb83254b400b213aad65fbf8524b7f3 SSDeep: 384:wPfZkah1oYh1qrJ3fLRUzqmpX/yRqh7V6yN:OuYh1q93jaOml/yRewyN |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.56 KB |
MD5:
17b09d9b52c16ecbbb42dc958147cf46
SHA1: ff80e0366070bcc03db55a20db60b05241c5544b SHA256: 28f2de35d6278d2c729c5cb2268adbc2c6333df144f7c5a8068f6afec6faf3eb SSDeep: 48:+LL4V/aQCawlGwElvsn1zUoDzoYvBgXidcn:G4VJwcla2WVtcn |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.60 KB |
MD5:
223c1e7be67176eaea1f4e63378670fd
SHA1: 72c50151c5825aeb5aaf1e64fae0ebb71163ce55 SHA256: 541836775b994ea081f2c726fec7496a5bf5a8a43216dc236f337ffd971ea046 SSDeep: 24:gHg9oyEO4K56TsfD6fY9sXjXcwb/ZYEPpY9LvykPXiwBYSXe8x2wO1dCuQrk2lRH:gAZ6Yb6esXxHpSvyLwmSX61er12cD |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry | 582.61 KB |
MD5:
0c2968dc4fb120c72e922a1c48b5793d
SHA1: 91f2ff064b0c3075a5714df387889062bb12db71 SHA256: 7f1a8b2005eef3537eb5390a76164d0d6a08d5d7a3b2bcb3e75d8decd6ee1ab2 SSDeep: 12288:WhDRpJFVLYnU4698rNVwx3BXxDGkP+4cUj4yWu2aJMXzjIFOLPVS5:WZL9oI3V9HPZcUj4yWzcMjjak2 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 3.36 KB |
MD5:
f434f208ecbc883fc6b494a4a693f383
SHA1: 837366e104247b0942a1c81fe31a932290ae6e2f SHA256: e8318ea37b8060da8de1a8253f92e4eeea094ff8aec363c0fedc2fa653c76ffb SSDeep: 96:YevLWaG1LvMiM2FvK0w6DihYWu37sQd6GKfMKc9:YkL+LvMiM9DICQ7szRDc9 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 5.97 KB |
MD5:
cf6c283fdbc1de17445218ac037c9931
SHA1: dad4fb6d9cfbbab7eafd7a59c60367cb844cdca7 SHA256: aa5a72ffcd2e745787f921bd69fb3af3d94deaff948d2e7822ff9498430fb45b SSDeep: 96:L6H1fKL/3ot4knfMRgXDRhv6S6RylKeJLfe75bdd72tnZl4sUwMKdWtBfHM1XRan:L6Vf+/4dMSv6NIJmVbddSnr4scACHELm |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | 865.24 KB |
MD5:
d8859124dc9909b335a2e52061cd8705
SHA1: a6a273793f20e642dd041c6650730f828a7dd0ae SHA256: 93e936e1675f450c11f90d9cd6580cf65628130dc26fcb66e0574df527344915 SSDeep: 24576:O32NohAYA3KDn4NqxoQiP9y1EtI67UJBBGOmou+ATqjCjTOLybzUc:2YsjjxM+iMBBGOmoNATvOu3Uc |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.85 KB |
MD5:
06f7ca124e096b1fe207a372d0398cf0
SHA1: f079e33e1d93a3099ce92aaa8619cb4be00cbe12 SHA256: 6ae7bba2748f36ebc57bd8f711d261bbc3aaab5c733c6167ccf67b50cf1e93ad SSDeep: 48:QJeeRoiXKP0bGeoYdHaWzJO8pwwJOFBxDf5Er4OSV5/yodTpcAfIkwctGJLnOTcV:qeeRrzHHPz2mOFjf55OsDTpwvwcV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[decryptoperator@qq.com].cry | 8.94 KB |
MD5:
4d8cc00fc954583e059ddae5f05d0fbc
SHA1: 16e4918c5b70b4763764ad187e69a110122ec535 SHA256: 448d90537c42b939f172a500ebac933cff9cfe97a7a1f238f4a4a933792ff588 SSDeep: 192:01+eh9Qlsx/uvjr6fcBqmjKNqDjwd6Kdax9XEGSa8kwAe5uN+hjoP6c/:UTQA/uvCQKNqDUpMT0GJ8NFINajoJ/ |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 3.54 MB |
MD5:
2da937cddbde9bcda2bd6d5018ef33a5
SHA1: 8414c016f7e0f8a69c5bc3ff0c260b7f09d62906 SHA256: 6bedaaaff93668292eeda5ca80fd13d25a023cb5383b81dbb1d47f11af6928ad SSDeep: 49152:AeFNMMFrwnbddIOxFOSOwPFhbYRjfIDPHLoBTv5oJBB47q5FqciqlqjX6nM:zDMUwxyODPFhbY12HLodiF4+5riKeoM |
|
|
| C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | 378 bytes |
MD5:
da5f19a08dd26102d76fbb78b074d4b7
SHA1: 418386b0e865c4bd995bb3d51499136fa2c8374d SHA256: 4cc396c233a48dd41f02f16952d724ee93fefbb6b74fd5b70c40548d222a7738 SSDeep: 6:UlFRz80kxtd5LVbs8mSU6WCt9qiNIhHcwNlnpE4S48s4Rim5D6C/QXet:Enkxv5Ly8/HNIhHcUtlS4cju6 |
|
|
| C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decryptoperator@qq.com].cry | 64.25 KB |
MD5:
f89fd741eaf7ddeaadb5bf8d08cdce7d
SHA1: 734d6db24572f16d5e241a3860a347cebe9826a5 SHA256: 14a36df853b30eae5eae92508d1a4d63314b3248113278458cdca132f1331167 SSDeep: 768:mmGt+0EEm9pPjWs/vhx2yP7CuUJFlKlO0Y1GQdhTpB9LxvntgbDUA3aNqQ8+DHI1:EdA6+hfTCFRKlusclTntgsoQ8CHI8TsR |
|
|
| C:\BOOTSECT.BAK.id-9C354B42.[decryptoperator@qq.com].cry | 8.25 KB |
MD5:
49931ea503aef3c813d1c9336e4fb02f
SHA1: f73c54ae30a6fcbcb2b53029f98ef08fd7ccacda SHA256: 7307dadaed2826eea9dfee747cf20619726013304acf00530dd79f8cf3c43f06 SSDeep: 192:UYgqGiv0xeI8B0ZssP3nSSedsDkPjuo5KbYIGcR:F70xePWZ/3redsDkMR |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
fbb9127ea9bf97d78f589505a0a6281f
SHA1: 87345ae195e87b155a8da3b07f7ea373b7329a79 SHA256: e0698f5975bacd9c3f20f5d660707789dc62e4457363e42926c7f2152412ed6e SSDeep: 48:xAp8vUKdWhF0UXsHmQKdzgEcnEJe9pes5fn0teWcv:s8vUKdWhF00JrdzuX58cv |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
da53a2fa054331cac2eed871a8cb1348
SHA1: 3583dbfde95742a09049ca5472de8f0c2f4a5283 SHA256: 374129657504bdb29533e0d168ef29040a1b06333941de80aebddf167de0a931 SSDeep: 24:nHffyJVAIWfh5ZWoOs5XTXSHVsJPQvFDGI/vH3dOy61sNYxpfrSVF6jVXKH4KQnT:nHnZXl3lTCSMFNOPDfuqXKH4KnOeXcZ |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.80 KB |
MD5:
35bcc9404a17d31dc9456b6b1d0e5992
SHA1: 78b7da896d695df0c0b24400c34dc802500ddab4 SHA256: 7a41026b2e94f704cdd337d57586214afc995219917d2e7a4c61b2fefd5252a0 SSDeep: 48:DWWngfkypgb+HBVWz88e59i8iGk9lir1rLu+524LO0c/:DLmhabEp8f+524LO0c/ |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.07 KB |
MD5:
55a36659db0e51f1faea534f72d0ed68
SHA1: f05a92ba98071dc8474f72608b862aa423978557 SHA256: 8843b34160d622765a62c6c173b74673f2c9a88c087548e50b3eea149bae053e SSDeep: 48:L0fOx46u864wweuVXKR4aTbk+5AfylaEXEVFirSvcSc/:wGJRwwjOTVaHFVcSc/ |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.76 KB |
MD5:
f754bc22c636917c9a705da9ffda3d9e
SHA1: 8bda1e17bf887ae90a709c3de3df99fb4a4aa162 SHA256: 33d6591999c32bc4e36b7c7318086fe4861c70e847f88a97819c1bc71af654ae SSDeep: 48:HZv24WSLvM6ol6L9HZXY7y4ZhWNmB5dke1cR:HZvxhjulGTX+7bWNmLLcR |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 3.36 KB |
MD5:
b61bef7b1ff22f68be00fac000738d9d
SHA1: 37ddcdc37a1535bfc1542b82be0482a84b23b85b SHA256: 64cde24c03ba4afccc819f0532f83d5d5e6e6f79768cad22ab2c63e39e46bdfd SSDeep: 96:ILRq5Zyi/y2s49eVycA5fh+WPrzOvxFZKYc9:ILRqyi//soeUcA5fcWHUxFJc9 |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.60 KB |
MD5:
da2cd4c0fec8e59b1b23bf915de53de8
SHA1: 4da4ae979e8cf30008556c9c0a3c4a08f554049d SHA256: eca2fbc45349ac8a8cc5298c2970d888043f2d415a75ee6618aaefbe0f8622bc SSDeep: 48:+EOBvMB7eFbQVsJF0CzABmfDVupRlL32Lb3YhezKlcDHbEdNzzcQ/EDT0rQR5i3m:+5BrbQVsJK0ABmfxeliLbC0KlcTb6pwb |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.99 KB |
MD5:
72c69099d419f05734021059a4e3f72f
SHA1: 7002c63ffd4e51ce880219abca5e1869a20b4917 SHA256: 42700bf08c9feba88a0b5c6b11603c2bbfed9771959c884162fd5591bf150130 SSDeep: 24:f3E59RtFhulc+ll7oNrXVzdDTrqs0W5B9BHwZW8VuVNtGXvOXtCkIeVHoLezxSem:PZcR3DTKENHwYVN+upXt+vejc7 |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 4.33 KB |
MD5:
1841d0d5817c4ed12b0e8662f9f59907
SHA1: f488cee894b5f723843d4554fdfb1ad2f2274250 SHA256: 192298b8c186a1f3b544df0e0359a4deb9d039587b545b4c469f8482b449ddee SSDeep: 96:sM9vQulcQwrC0hsZIUkagfG5DmN+RvrjFewVV4RO1+fc/:sM9vQulPuIHxgGXXzcUGc/ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
12d3d4ab325f8d311946ff9e204c17eb
SHA1: 547c530641c09bd231a4465a059778902331dcf4 SHA256: 71405985ab007c9f38adb3477026f7f3764a9700bc0b58461d1f167879e8f51f SSDeep: 48:61CYN+sXIxRe66LvSwRovKc0+sBoWR2CBc/:/YNwRJ6Laa3JBoWR2CBc/ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
1e2cbd179dc504ad580a1919664b2e75
SHA1: bd827807d223b14f27da2e8b25bc12665ed645c4 SHA256: 2f6ac3952e34dced8c6eb0146e2b2a5d5e7c4959682dfd443476f4d6d3fb0563 SSDeep: 48:vb4rd/kMjEvotfJtmWKLgzCTVeTd4F16c/:EB1AsTQgz+ks6c/ |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.47 KB |
MD5:
2648af17a20e0e8dfcd0c92ec0983a52
SHA1: eedb39c66b019fc68c5eea55c6a797f9dec252e4 SHA256: 5b54a351c6bcd7c5a07b1819f1faf23621a52001b78587a6e3032d76a808171f SSDeep: 48:ZPAkfOihEerGoOWsfewKoktSSbqcqw7FLcqmGwPcnHQYIKc/:ZQeSoOWoewKf0qqctcynwJKc/ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.03 KB |
MD5:
4b4c8c01b9938942321b4a282487d99e
SHA1: 0832b3f5cf7b47098689f0a9790a8ef41483a0cb SHA256: 021b02943f88be361540a308a9ce89c12d4ce8d3e44a956506564719bc014a9d SSDeep: 24:Pqo6XaLsTQ6aZsjZPnGLxclqX/hUNvztkhLzcYvpiVtVcTt:PsBaSXlqXqLtuLFpi1cR |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 5.97 KB |
MD5:
029efbdddec0121d97139fb7fed1ce53
SHA1: 9d1d4a151954715ba247072d75af3c81bfb32b5f SHA256: c01b62e99a83bc82fabeaf95801fa53a56ea47ff09b8fd5a02424604d8475fba SSDeep: 96:/bjHGgY4jle7Ojw6KkAi1fxO2zb1BWRtir3BecJhmTSHBAdGRLVikHr4C5c/:3HbY4jle72PKhi5fdii7BecJhmGhAdGU |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.60 KB |
MD5:
89d89476ac2c03bfcc143c05b1f1f614
SHA1: 598dc6d01d49a4f920f66b55ef42a27a14618ded SHA256: 8969e061903b17bcc3ad0f280f5505232207a8f970799a7fb6b9b79462a2b022 SSDeep: 48:ogKV1OyAu5gVDjtLvBuRN+9fFZ0k1eHYcD:hKVgTBVDjxpcOfr0IcD |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.54 KB |
MD5:
509a6d5e0dcb6cad9a2e31dc8d60fdf2
SHA1: 6d9d901f0e39c87202d10bfb57c34e7bde0a2b2b SHA256: 0d9768157381f427993c5f7fdf645e1c7654e5a067a819c3ef1a98d79aca3e42 SSDeep: 48:4kHArXGBWL40vYyHLWhd7J5yGlHMyjKvuhwDYndx+dttWc/:PAjGB2XvYGWL1BlHZKInd0dtsc/ |
|
|
| C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.04 KB |
MD5:
78fadb9da18da398b4d372b9d1eb75d9
SHA1: dbf455987d8a0c7c4892cdfab58bd875cff2e0ba SHA256: 781c473233671b1e183f77ee236a19c7379b08184f069060ebfd495c75142d30 SSDeep: 48:R4MZmItAvddVHc6ROLlV6MwV5n+bWTNc/:R7Zw35zRIwx+bW5c/ |
|
|
| C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 9.51 KB |
MD5:
bbea6a6ec29a13e9de5ba1a2afe456dd
SHA1: 5ac4fa7d32ea229357a59b958dc20bc88318b2f2 SHA256: 2456f3058f98d7ab5049c624632db14ebae59e491b5fafd7a8f1af3f61809095 SSDeep: 192:y4hg16augT7e/qJsvYWZ+v4NHjmyVZ7vJhhUfL4e6uAXIPyCctiVcR:yrLT7eqRw+wNDV3hhkL4CaCYR |
|
|
| C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.07 KB |
MD5:
40d0108ad15fe1981ae71f699ef24ecf
SHA1: fdf50d77129cde7db49505694e8ef21214d059bd SHA256: d9ae2d5c093b95db949af6d81223c908e91a520fb42ee533f95e50e146f40487 SSDeep: 48:UOUZK8hSa6y6PHZkBqVMBGHT2srrmGh5a9Nc/:IHoy6/ZkaMBGHxWQY9Nc/ |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 3.14 MB |
MD5:
f0c0c342f83e0b0509a09530ba1daa2e
SHA1: 37ae2397401425579ddc7e2f39316ef9873dc1cb SHA256: 3ee33fc2c4e29b00cfc2078ab92992882f9adb137e9dcafeb62ae7f194bcc4a8 SSDeep: 49152:zDxL8QBo0Tex4S120ytJybwjKehJ62ilFotoHqSATH:zR89t1/eNUFotCAL |
|
|
| C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.81 KB |
MD5:
7da6eceae572a724860687905c281e92
SHA1: 09fb9423a13406a9313fea45faadbb3badf6d5b8 SHA256: 6724f4fbfbe2e8aa816c7d1577bc73829f13dc0efcef8c751ade823ff2155e30 SSDeep: 48:SvyXDHewjV5hV5a5Pa4YKSYm+Fbltam1aleLc9:SvqXlSPXSYmxm48c9 |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 5.67 KB |
MD5:
194e74a87c6a2de38106e05501111f26
SHA1: 4048dda3722ed35f7be338eb6e70bae2c15a724e SHA256: 57dc07c8da3aac8427579541bc74e9a3caafbe4c41fbd8858853ba046a0c19cc SSDeep: 96:XzV7eG0I/FAHsia0nMwfQNvoNhleLMlJVes2iFMudtuwmxorVcn:BKoiaIpfQNvgiMlve3iC+udxorVcn |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.05 KB |
MD5:
df1b8e6bf61a226877f3970fd927e763
SHA1: bcabf9fc96ac2e9e1924912831355846946d5dbb SHA256: 07145689a1f9302d9178d1dcfe265d7f7c09339a80fc95c31578420d519bdb06 SSDeep: 24:rijv/pYAznbev95u+9bFwBf8vyFO7MUqt1cRWW8S2htVcZ:rOtzny95u+9eBfYyFH5iKS2RcZ |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decryptoperator@qq.com].cry | 26.79 KB |
MD5:
5912665f096156ff658a137a5020cc71
SHA1: 98824bc021d8e1f2b3d5cb1d46c98fbee279b14a SHA256: f39739b80e5c29b53cbea2c8a91d8e082faca6d5033c13fae636897f922fa647 SSDeep: 768:T2L3oVkt/WvidCB3H18/5Qmnhoz9sA5TTfhffvsFfV:TwoVkNWpZH1xqo75PVsFV |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decryptoperator@qq.com].cry | 65.85 KB |
MD5:
03bfd0362ba038860caaf99095d9b23f
SHA1: 061d40feca5dcfed3a2a4adb9e66fe282add69fe SHA256: bbc4748a51d7b8710a1d2e094eaff783a5e18ab8b7fd853f66251b7833049b64 SSDeep: 1536:CV0+SmObkBBDxHSU2RUR1E62tKXhvNPopVsmIQ/:w0AOYBFxf201P28hvNTmB/ |
|
|
| C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 6.33 KB |
MD5:
94eed9d607c6a08d37d1d23d7e10deb2
SHA1: 70ec870f77f457f48f2a216679500d07f6a41a83 SHA256: 1852048001cf6b3f829e441dd80818b43c75cbd4b337704d6b02f101c1be4ddc SSDeep: 192:TE72zGKAOM/EiwQhy2F2tgiGSnhKBuJi6rv9c/:TE7k4ZqQQ28tnNnhyugkW/ |
|
|
| C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.65 KB |
MD5:
44c83eb63be8b50f69e009cdce125883
SHA1: 636e90146155120e85f07f3d9f8522be3a5807a8 SHA256: 63f9b63fdebaa31382b5ae0be176457754eba8c42f474a898a9538c425f1e4c1 SSDeep: 24:JGTg555mLZ3HvMzLfYpYOPOdCUhaU7FmtZnPd/Lx9849ThxYtET41LiRtVc/:4TgpAXozn7edjLV9ThxYw4sBc/ |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.56 KB |
MD5:
83537c74a03b364b6d52e19ee06ef1be
SHA1: 7cbf41dde8ddf477265f9d6e7928cefc032968bb SHA256: c655ec5d0a4e5f1469dafe3a4f95a14b962501bacfe32ad3081242fc821d1ecd SSDeep: 48:SCPokPCb+GPhb4SmtG0lz04211z8/eOcn:jwgCb+Ab4SIA1xmcn |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 2.80 KB |
MD5:
4de0df57143fa1e4881c65611ddeb5e2
SHA1: b94d9cafcd03a6bd6d1dc63fafd361b8bc5a93be SHA256: e8667bd6beabed4fc213b3480910f0d9bd4aefb59517cbd61028a5eeaa69cc77 SSDeep: 48:UwuiVFwV9lieH/O9067hAJZ+SEptK8MkfbqO1pUPfwjPNglJNzxt2w1CKD6zn7pF:7u39PHb67hObE/TMkfbJpUH/Rxt2wVML |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry | 1.05 KB |
MD5:
52f080662aa5b42476367a92d761584c
SHA1: 54f16c974b66e6ebf3bcf626ea2efd44f0b0671d SHA256: c7a77aa98791c36ca3f77eb71c122a33be99b92c65e9d8cb5f0ed1fc1e19a274 SSDeep: 24:guehdrMK2YYsonNnjut6ZjObCeL4MIJQDpwEtGOjlw8PM/SWS2O6tVcZ:hUuK2YYsonlfi4Mb1walnMc2OicZ |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry | 582.61 KB |
MD5:
81d0e9fb5933e9563ad9b8db1a8340ee
SHA1: 375474ceb68d17391702ba2f03aee75b4c61b851 SHA256: b802091fc517640b8bee5ff82d0b9df6beba9113002cbeded700958dae3a5b1d SSDeep: 12288:Sa5JVH44EB5CUiQLvx+a/m3alfddSgbwmCtywQD1OCKxP:NXYD5CUfL9/m3kfKaqtnLxP |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 4.42 KB |
MD5:
bf90d6ab6c232ec26e1e6a296c53551b
SHA1: 20438b0a525f7475c8721abd742a971b14d3891f SHA256: 827cd527e5ff8778fb02fce5ac276e6939d1e5204ee24975043c2cd49b48d9a7 SSDeep: 96:XfMkTB2F+wgM6KdMfDW77I+kL6Lktsc0VTl+Rfc9:XfngwwDRneOmJGlgfc9 |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 6.51 KB |
MD5:
ef88b32a2de581062855febead3807a2
SHA1: 8dbbed6c240a305b48bffbb631a726af70add2cd SHA256: ae6818ed30f84601e6b3604c0bd3bc7c81d81edf337765c72f4785308f4e10d1 SSDeep: 192:6E3fssFjOz3ldsRS37wrjLY+OjOY26CdCekcEz5Ccn:6obFS13s/LYtyYQCHcQzn |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 3.14 MB |
MD5:
b498b20f19b902dc41463842cfcc1d08
SHA1: 7dd7d383d5d708ff10534827bbc162f249bb38b9 SHA256: ea8263bba780d0ed2c5e5b7b3dd4cfce9c779b7a9a75c9b0232f0f6604e571c8 SSDeep: 49152:zDxL8QBo6Tex4S120ytJy0T1l1uIV8QSf9:zR89j1otDSl |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 16.52 KB |
MD5:
5ee82e7e1efa321a38e7207013f98c41
SHA1: 69b7293c74c455d7d0e9b9f5adf5f834d8eece08 SHA256: 0c1932484f4174ed5b71ae3d9e9be3028db5aab973d7710aa31e349cdbe4734a SSDeep: 384:CsyWk3M8mnsPEJOwMBjqmj5rADy2ndzRAEUPXnvzRR/:CsyWaPEJObZC22ndR0zP/ |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 67.85 MB |
MD5:
6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774 SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 4.42 KB |
MD5:
0542b767e8fe450683f30194dd8c2b87
SHA1: e8619c28bc1ffa38c8dc9cb643f7cc7dd87735eb SHA256: 4670a331fdd0db6654c3e6f412a9da47f4f5922f59393edcdf2bd4b8f2f08461 SSDeep: 96:8hNOgiRc37Lh2M8EsUTw8GlXWc8aNoEXciuVXdcjF0Rjvcc9:8hNKR0dwd7NVutsc9 |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 4.42 KB |
MD5:
55b4620da8c292ce555b5a07d0144f26
SHA1: c3a15ccb005bdbdc50d0410d1e16e7181df68544 SHA256: 6bb67cd2684d79260d7a9de3eb420dcc7b877f011f4eaf37b87154ed177660b6 SSDeep: 96:AyiqbF7DgBnPQ271NXEwROpjwIVYV3tNfaPV4QWXjjveX1oitc9:AyLFgBn98waq3Ct8vuGkc9 |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 16.70 KB |
MD5:
aa79e4bdb0c22a813e1385dfe9f06e27
SHA1: 860bc608a459b84684319baa72b721c2e20d302c SHA256: 61e32f74e114cac594174643c7f92021ad975c14774c7ef50d51af301c8a4351 SSDeep: 384:zF1JJtd5COXOV8zX3qWWrBJhD0zqXc2lZln3ygURMdkv8+ZmlFLPGNCJiJJ9:zF1sO+CqWWrBJGzn2lLHSxEFakwH9 |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | 30.60 KB |
MD5:
3920958d2d6e6d143bcee51472f273f3
SHA1: ad5adf2fcd61e45f4b1b7cb68587b373fdebb90f SHA256: 46db404e1076811f601c92685cbdca4f0046ea8851588f36e729d944cdc96b23 SSDeep: 768:To2l7cbZW33SUpNRLxNy6qyl9tDpyeAF3+2xdbHKk1qK2/:To2l74Q3VpnLx1qyl7DFK3Duk1qJ/ |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | 8.76 KB |
MD5:
1c8b34cf8f9df2b1d427c466263e0f03
SHA1: 60841cdd70a83522b582946df06298a8f74d39fb SHA256: 6e637b764d76947707a72d64e131c67af0726f66d41f524e4d02bd7b8412064f SSDeep: 192:GKLbhkj7oy8dcHXfEDd9UwPi4a4Mm4xc+oh0UcR:GKb62cHXfEDDUwPa4kw0PR |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry | 1.27 KB |
MD5:
f350689d685a33247c8320508f7be884
SHA1: 4775f90bd0e24370e648f3768632595853ef625c SHA256: 354cdb127d5e6aad71cec04d09471c291d6ca8cc115ef4a91e9bb88542d8967a SSDeep: 24:vLcnTgAIZM74h/K0DqXEyqs1eHjr5iFpGlV9Vvw+r6JuoSQlJcsE62pNOAMZoxYq:Dc89ZMpsqRq4eDr5e6vw+r6JBlJzE8AV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry | 1.27 KB |
MD5:
f1b57f995c4424290ddf75b62992805d
SHA1: e94a03f9d7f973859b7ef5ef088dbc11d4cde537 SHA256: 258c60ce28f7018275377b12174c4f2d7e897cd1eb524dd0345dd21e4ce2eb92 SSDeep: 24:DZiO23vaSOLC61Bvp5Ud9q72DN0/22BVHBr2fxaMgzpDp3hCe4IJ2xdCStVcN:oO23SxC+7Ud9q7eW2QkxECe4RcN |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry | 1.88 KB |
MD5:
aff5e47f4704a95a807b1b59992c665f
SHA1: b32074a86f2210fa752e9f84e6866f19aac6b503 SHA256: babb84d852dcb1169d9705bfd4811f38e883cb582229e01770075b5aa294fef4 SSDeep: 48:qMY2Fbnnqe21xikWaF3pu3iE+WDIdUQa3MaHzKkkacN:JY2FmrxL6thL3MEYacN |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 3.15 MB |
MD5:
09e81942f4a0ce36d9eca8c06a3c01e1
SHA1: e5b4bb6798a6b3b23479516ed3b7ad9e9731af4a SHA256: 1470c545ebe2d249a77c961e602916cf259822018e21783d60f807640928ff7f SSDeep: 49152:zDxL8QBonTex4S120ytJyQltgxV0pp6uavJzAjWpr:zR89K1A6xGpMDvJz6Wpr |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 10.25 MB |
MD5:
84b60cdb20431c41f05666896bec6899
SHA1: d3ba9e55dc0d1fe5bc78138b66e255294be1a09a SHA256: b70c7e4e96dfa72f6c72ba65aecf6d4696e2c3425c885ad369c1ee329482e883 SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+k0Pl:MUvTiNhU4L7tZiTnprP0txRsn |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 14.88 MB |
MD5:
0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35 SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307 SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 42.53 MB |
MD5:
4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63 SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 3.48 MB |
MD5:
ebc60c4db49a7b84dad9d7da2edfd213
SHA1: c5e35fed004d5236060f7021237a8bee0638b1f7 SHA256: 34f4900e7ae4e78cef36a660c74f39819ea4ee151c07964fd20f96260998799e SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6LWu/zi65f/rGpfxQ7cYM:fqLVW6v3XziYf/apZQXM |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 2.35 MB |
MD5:
69902d844f1d5ea495c13a8a0f5c8abd
SHA1: 2bb92fce2d64f4818ef050283320d8fc386a1178 SHA256: 7f911af1adc9da79ecb03d555695e62cb00e480259cdcea220a3acaae3fe99a2 SSDeep: 24576:nzyc0opacbhmgk5gHL7a35AyjQgz9vzBA4rdeNkzfaZjBde5iPfsVOoejlwJf0x6:R0opH/cgHa3HRxz+4gUiZ9p2Oz5ouxUn |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry | 2.13 KB |
MD5:
c13b9535dcf903ff531340a38408a996
SHA1: 8aad78365d0a62fb34ee37530d5208fd6b9fc4e1 SHA256: 4ddf505ea8a6ef0cbe45e87dc2f6ada3bb0041df297c736c9fa2c5896eafae9d SSDeep: 48:M9jor0rDG47Or4X5Mpr+j+m59/0Tc22PL+jT5aP4gcV:qUr0/G47+r+jn59/0Tc22PLE57gcV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.80 KB |
MD5:
8a1cdb731239e65c8137e4e5db5c5b86
SHA1: 4e52488531930e3b33f0360b9e6e68dcee1afb82 SHA256: d00e787ef2b87333bc967b83dd5fbf4d0907d7e0eec701307546e8e6fe8bc709 SSDeep: 48:34K5sab/ERHvz5SQhQvVGhDk0MV716sDgSRytoiGTRpuiuCQyR4c/:IKSarAHvzgVvobKXTvDQyR4c/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.05 KB |
MD5:
19c5eb66d7372788a5556906271de404
SHA1: 9cbe343ca7dcfa286409593ade21c2ab72e8a06f SHA256: def7e88012d67482f11c244b5fa5350910bc9aaac2bfa01250b362834f6c05e7 SSDeep: 24:AikwYgcenMbl72dqZpSgiCijFUX/kB2lVnMOD6jFWS2ANXUtVcZ:RkwxnM16qZo7UbmjP2ANXscZ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.76 KB |
MD5:
d3760d61850a4a9c125dec22a2b59f80
SHA1: 0d885541ba76f539d64e9f009321e98341cf9ab0 SHA256: f305f9877c9db45fb30bfe2d1eb825b4365044c07dd556b5a381cbf545e4686a SSDeep: 24:yL+gqVZ+zd9Q0ntoM22JnLibfQkFkntwhmDcvUopAHXAuOXiZgNsY+9D70Av/dkM:RA2jQnL4onyQ4v5m3hOXwlJ70Av/d8cR |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.14 KB |
MD5:
6331e12d82cc0e59b543ccf271549f28
SHA1: 464334f7248aad0a2496d05d27b61b46b7a76fd2 SHA256: 381270de72ec23ffba3c96c5e7096a0cdcca90d8e1e448f68560a8bf0dd9010b SSDeep: 24:vPRgOwoGN1eIn7hIOdhdrMIjOzAEyNljblI43N3XgtVcn:vpTjGZtrMIjOzAhNtblIORIcn |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.65 KB |
MD5:
1a06446ef88c17abc4dd36579c45856f
SHA1: 0725f74007ea5f091f1ab37c0839e89a9a084a5b SHA256: be096467a69044f2a42e215df370e1603272095b449f7dd5d7cb1dc278c3409a SSDeep: 48:WawoAwsp1StJ3L9zZGQLuvnjtedNmfG8wc/:Waw7wspEJ79hLuvnhwc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.47 KB |
MD5:
1cfab2c2636ca7b4c800e5d7d50dc728
SHA1: 0d83d37bafb9f2f8c71f53e988d1f28aacd16cd9 SHA256: c690af472cb6d721903b95ba77fcdd52b4c0c33ca7857866be95917978749a12 SSDeep: 48:aSRRwRjeivRRsVTQpo9eEgHANHe6m9y3qCMMsEE8hFXZwz+BwodjpWKgmc/:1w6aRSTMo9eEgHZ6e+5NFhvBvj0Kgmc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.44 KB |
MD5:
3f86cd37adfea6d4da7c3ec682426c60
SHA1: 09719fef77e0a9dce95b30dc025fd278538a0d61 SHA256: d1d5f019021a66b40def1540ba278ba662dd372b5ede5da15f1899d22365642a SSDeep: 24:KtfWPQDTY6QuKztNQxbGP3bGkIaClpmsfaMGdrAT4z/FVKJ1eWpFT3btVcD:KtmQXOu6OxSzsaClpN4u4zETcD |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 69.80 KB |
MD5:
207e894c1617d9515e64763562f678d8
SHA1: 5460594594cc2ee7eac2863fe3403fecd92aedef SHA256: 203a630070a7121aa6ea0a0afb691f0eefda565113030c69d183905d5e7efc60 SSDeep: 1536:vpSnTk/zaYFmWbY0lKrapwtYyPh3Aj4Z2NXxr1SWZu11G/BT:vEnTCWm1MQK+p+h3AUgNVUWZu1EBT |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 5.67 KB |
MD5:
ea76142c868055278abd99ae6ef859d8
SHA1: ce7ce9824850ee08f9327659a52ef24f09e97c8f SHA256: 085c7657d8fd215945ce11223fccc79f39ea9840c1c32fbcee038e52e02c40bd SSDeep: 96:XcE6a7pPtVw9/gzHZ0+FQyB/PSuwq0FRbPsGh2krhhzWOhTrqDZrtua6VSMJk91z:XtP769/d+t6uuzh2cz7hT+1MaISm4e3+ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.05 KB |
MD5:
0af7af35e6eebba4e7c80e0b167bace0
SHA1: 4dad35a786c168672b82675542f5d794726740e8 SHA256: f9b078701b19c1040b08b8b747042eb02ca5aa9140598d72e667ce81595e7c4a SSDeep: 24:kZqWVYe4ctIkCp0guAoToIqti/YytOZTW5MUtmMx99S2zhtVcZ:A4eTEp0guAgrOQ5tf5S2zRcZ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 26.54 KB |
MD5:
ca4b82360e39f86861b37ee41409a6c1
SHA1: 53f52e58e27759aff4e9d9f184ef10f9006d56a4 SHA256: 74ed18a3e13358bc031e29384b62c9c503b2d2346a9c523d5d95a0dfb0b735e2 SSDeep: 768:oCGKkF58L7nkPvC5PwhkdQNjiBsteUXNsAFJVV:0F5bPvcDGSFcV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 37.04 KB |
MD5:
b711ab63ee2c252419b719b405386fd6
SHA1: 2535f3c0947af7dc935b2493ae56be286424bcd2 SHA256: 8475ed5250cf406117ec003e5b452c019676bbb9e05560768a6612da8f852691 SSDeep: 768:5qbyWS53awO07Dob0kwfh+faEtTSBgG9pmPfFXl7V1C/KaR:5qGWS5ApI0fa6TukFV7VRaR |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 26.79 KB |
MD5:
a1b61d50e70b6479e364722465e0706c
SHA1: d4910d8f2344e9b31f3cfbabf40fa891901614e9 SHA256: 7b697384d5004eb53bdb1cbdd6b6e9bf1581eaa7dee11f4d919d161459f5dfd4 SSDeep: 768:fuKumz4huydl8IX8AQQCscjs4Jzp8mudwV:fuyz6uNIX87Fbs4NymueV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 9.37 KB |
MD5:
e48150c11973c885d6c959fe869f0e7d
SHA1: e893b60d38932e4647448800599ae4774243f5ac SHA256: d8091bb768d8a8ee7043eb51a8a5cf98ff55a4cc81231b9415499ae446310efd SSDeep: 192:lMo9PU0boJkeTNVwxDshS+bnlWi6PNutiSPQ+EzzrL8tOOHmc/:NUjDVwx7kZ6lutiuh0zbON/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.54 KB |
MD5:
3552bb186963e9a1db4f63b3353d5a63
SHA1: 069382125e081486cf21fbb3dc806c3a67386335 SHA256: 0a9a555645db21db83cdd064f9eb1906a3e4dea458086075d013bbf3fb2affa4 SSDeep: 48:JiB1XEoK3ju/hig8JnS8YPYzo5qvBsGCjGEKCfBtrUzSjEPcHXawqj5rFq8jc/:0zXEPzLN1S8Ygzgq5hFDujV3aPfq8jc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry | 4.42 KB |
MD5:
8cda8f5faf6d24140dbb5a6ee1864211
SHA1: 19d8d772cfd3694b3ecd105aff7f2f27420005e5 SHA256: 31a8efd08c79b52f691186e5b40cab40f33c442145103bed5e73d8fbb5fdb6df SSDeep: 96:RZj6bqN3p8Mq/vBMTToEPrpHGbw9gtaxnA3lAznqL6X6YyfHc9:RZj6m1uL0MElgw9gQxnA3yzqL6JyfHc9 |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 3.16 MB |
MD5:
0878d1e108f93a14e8831dff943af1d8
SHA1: 504a47951bbf3300d3363b529372ca38715625f6 SHA256: 1a8ab2c5e66fd3d4a17a5cddbc124eda83d9133c1ac10acf69a6c56b924f2a28 SSDeep: 24576:zxnP6WBzkm83xgDBo8o93HeJP9VB5bxQrzVDFJdjHs5wuofLfdky20ytJytLmB0X:zDxL8QBoSTex4S120ytJyt+yo3TjoLIQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry | 65.85 KB |
MD5:
bdc241afc790c806735304a627dabdcb
SHA1: 2d1d853590ac88b7f04d858518ca6816cfb6a60b SHA256: 8642a6a90e809e32602b06bb13fda0e873a71eab7b4409603cf134a5d1c2581e SSDeep: 1536:XWnzSc2NEhBkgox/rfcG0ZCxzauowp0PpfiSiod+Ivi6751/:YSc2NE0goxjr0ZS1pqpqTod+ITL/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.04 KB |
MD5:
8d0851e746e855726a9201af35756311
SHA1: 7200399ab39e338b00e1eef4f4cdbcfb6d7ee890 SHA256: ceb220497825516bc53e19af199b2a56446922e7f0671d8d04841a779b7972b3 SSDeep: 48:ql3xVXEaR+vOYtZwqXLIuS/HSeyJdE6MQlwFMpKc/:A1QlLIuSHSPTpWqYc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
31021b3d70e5fe07e2908e479e6fae7d
SHA1: e2d02200b267837c94521a5d1b463b044233dc47 SHA256: 7efeaff35c41d660def591913033e0c8cdd00a6780b0228727fdabf5e687ae14 SSDeep: 48:WyysQEDOEFECEYlMZnIISWUEJIQkYRy4dtjUcv:iCEYlMmxzUMYRNocv |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 4.33 KB |
MD5:
79b66f0262f6aef34574ea34d5d7018b
SHA1: 67b2d26eef6dda3b7a6015dabdddfdeb576ba9ea SHA256: 0e25d3ce9285f4f62c0a4bfc5b4360a7c6f374e78c812c36e092ba9029a47f6c SSDeep: 96:xLBQJjwVWilf+SZMeZaF0uCu7Gn9WxLAMpo/Tc/:xNQJjEfx+qMeluCuasTSLc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.07 KB |
MD5:
0abf47dd866a88fc3f31f42dc37080e2
SHA1: 925a877b0180f6aa8d29c185cc9569380c95d905 SHA256: 8506c4b79e35e0963a80df7d124a866746a09c9e4105edd48e830ca814ad066e SSDeep: 48:LC14ceOcEHjJiIVuvQVA1PtERhvQOaXYtGRnunOR7wCKNoVc/:O14cFcE9BV5DQV8OnMOyCKNoVc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | 6.51 KB |
MD5:
94d0a59f1344802ded0beaf648e11e90
SHA1: 968726de7f52a2d8cf339e03d4b15ff8d948328d SHA256: 320ab524ded7d2725cab5c13026c1357397d6f9a51e4b08b0212891218a993ef SSDeep: 192:La01+Ii/IpeP+wL3QorhxoV4AY5B1osvy1oaaNyThJWcn:L3bipP/zNoVZaBneRhbn |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 16.52 KB |
MD5:
f9c097257e364e9b817d69906959d963
SHA1: 252b1e266a2c92d00370c3ce9e46803e1a006764 SHA256: 902063b472f9c152bbb26ea42a23a73abb266c5cb99cd0928eb438ebaca0e1fc SSDeep: 384:MrNjE3oe3g5UtN522i/kBGmSijGR3tmnnw34Bfpwc/:MrW3Y5UtN5nU0Gmw4BRwc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
b4fedd797f34502a73049c1a5b738a7b
SHA1: 76afc250af91e02b33d7391ebbed2422c50c5225 SHA256: 0e85438f209d3c191ef2018285b606cf390aa6bb6ecd852c304fb5072ffb9e8e SSDeep: 24:2gWsC1ItlY0ZqI0AFeSOkvCkT2ifD8ZxlrCFVqZxF87j1ciuoGCV8Z3uZc5ltVc9:QR+tleALLT2irU3qgOxGCV8kZc5Fc9 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.81 KB |
MD5:
452caf9394d385bd5e99995985864ffb
SHA1: db595f451c73210b62553763404ecbb3bbde583a SHA256: f23b93c79cb393a2a1d39667091cf51fa9a7498b55bfaaf7061b3e9d87c23d0b SSDeep: 24:fR1XMSZ88agPSo4JEppsMhD2z5fWFyFa2C+ffFCAbxN830c71UM2jpMz+07/FlK4:vXpPhGEpp6V+MJ1E3vKM2q+UFcupD+c9 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
992a2a574f7b6b1491c13ac7de082d88
SHA1: 1147dc80a8dd3019b34bf6568ad77e0a8e92e36e SHA256: a5868b8a7caf7c00c13d7c9037a33a9fc35e967cde46015f4205b274824ab55f SSDeep: 24:WHg7DYzfFp15IuKyRn8qK2nN8/xihryH631cEmsXqlqpf/GEd3rOsd0QAQ+ftVc/:jfYzfFi+1N8JADbmsmqlGEVrOss1c/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.18 KB |
MD5:
3316833d982aeaa2442811ef21ab76b1
SHA1: d7d0adade04fada6a73eb5c5c8510f9f0aa06c11 SHA256: 70e873d84f53d2aacc158cb0a4e123b53650d9673b189592aa0a38edae26bd98 SSDeep: 48:3/bXjq0u8nXts8f/C+XbIUSmpWcrXqOIELYpGFc/:3Lg89s4C+rV0oXqOIELZFc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
64cf47f9b5910e09dac99127b8c3ec9c
SHA1: 27cdfef6b0ee5781ee96e51c9393dbc020805442 SHA256: dce3de0ec318e4bf52a0df91e1c0108ea7286691d5c6e0c0d73ac528621e5924 SSDeep: 48:XKCIOtAlJVBuha4lCYb8WgLieRl+C5G8ALlEsmYc/:jOVCZd712+UZALlEQc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.07 KB |
MD5:
e2ffa35ef38e0a738326a0856739a679
SHA1: c1498e9491c571cf896221b5526ce8f91ffa0616 SHA256: f05bd282dacb8175f4891a92a64f2603d13f8d33b340576909f393758e699207 SSDeep: 48:OmLidRw7DUzXj1kOjT0nD9JCH+obS314zMTlS8//uUM4e8c/:LLisHAja5D9JCH924wTlzu54e8c/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.55 KB |
MD5:
be5eb3d61d93aa74177aed4f1936e23d
SHA1: 4be550919457fa5f60ab7c3a1699220616c698bb SHA256: 39059acf1502ba8a601b6e5f54f9df960483eb2cdf12cad174ae2c1f045afdf4 SSDeep: 48:Ms6jTI6bQQLNjwcQF1ovrCvYgLcNa/uvwHfGzu8sc/:AjXb/L6cy1kgLN2vw/GzOc/ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | 855.24 KB |
MD5:
ab24ffaf83f089260f861119e7447467
SHA1: 4664ad18cb6876e7e14538f001fd9efbfda78414 SHA256: 5ffa23802eb2625d68b2f46a88985112fe0d62cefac31d72c1599a6e3e8c4b8f SSDeep: 24576:P0lJ7q2//mGCRzrhpkVAGUGpYGUoWojltTNE:P0lJ53ORiRU3GU8te |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.03 KB |
MD5:
5bb99e25fb356414128bd88ede809c97
SHA1: 2f68996963223b1b69c8ba858b327e49956e2583 SHA256: e4f462f26ae004961629366fba1f4ea706dd7f4b2521c0271d9dfd7e3f6c5e2a SSDeep: 24:bODB7ZUdMMecey7XyuB+0yfGSTcfRw/tVcTt:b0BNfXuBRSTI0cR |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | 13.76 MB |
MD5:
42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163 SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455 SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.66 KB |
MD5:
79ed19269358e5410408f4d942ccdfe3
SHA1: c3c818fcf97824b8b75b579e17da956e37c17cdd SHA256: 02705c260199dc317b52ca70915a62bae45e4d63d6ff3694be222bbe717ec8d0 SSDeep: 24:k/0xC+OVt6dSdIy2ghJaNcVfuUhbIoohl6WCGFXKlZ5rOgqYFotU0ynpzZIollsz:lC+Oj6Hy2ghUc1kJyqYFot04jpccZ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 6.33 KB |
MD5:
be2f61bb6b495d84cd6cccc0ffef2499
SHA1: d1779b847fa6c6cc7e119914977a127b799ebdfe SHA256: 2e1f641ccfdd6f0e431eb085c18938127684d4c8b670c161e12f59c6ce7b7601 SSDeep: 192:w6s4J0GtinjaZjWHF2hYjWLfw6pNlLPfrc/:xsWLkjaZRCWLfjHfQ/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 9.51 KB |
MD5:
0ea65d9e635b23008a67fa298d581396
SHA1: 6ffe61fcad87164404405ddf3c14a297dcff16a3 SHA256: b56720aab6d82bd5d17eb385e50cdf8ae4a0241058f950156d838e760f93d3a6 SSDeep: 192:4uaObpZMNC4NOHr2JbkCp2KKp8v6FqRD6pVy8yEAywI9FfKzuMKjRHHcR:4uaimCwYrhd8v6kKVXyEALtuMK98R |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 20.33 KB |
MD5:
949d367abc06ed742274431d0d2b1de3
SHA1: 559251c001fe02b0aeeff1a89a54b7f9a257ab28 SHA256: 23ca24a2b4518cab59c89528507196a20846d94a23108f29325ec07e6bf7b798 SSDeep: 384:6ru9zUPcgZTPJ63VBiHbhRF0iRB6H/cD9Ty3BIvMYXNTz8tvRw1KDVZ8SSU/:T3ETx0AbhR+OG3BIvVwi6B/ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | 860.74 KB |
MD5:
be2b5646cf2536c1484c407e2f27227c
SHA1: 9bde3e16751bf85e2352cd65456389399bcd4051 SHA256: ae15f70e2ef202b6c3a02d945598167781dddc762ac3ec67e54eca46ef1a09ec SSDeep: 24576:YWJIdE4BNi0KPWJ4kDHpgJe3Hrn+K2+q2zGwGiRNo:JJSJHi0O44ktCQn+uqYGwbm |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.80 KB |
MD5:
9fede4fc96d79f71d9dbe917984acd2a
SHA1: b67be3f93bff5a8a8f2d4ed8817f39112be027f4 SHA256: 4eef97e033d1419b0053f662aeebc98990f4a1f4926b1070b6892e03229c1bed SSDeep: 24:O+tcrgElBTwzd9p/zxcr0V2DTvvMrP4dlUdlW1O5umAvjwqS+jUB+86gYyVSpft8:Vc84spL/zOr0QD7MSyxumAPOQbXc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.60 KB |
MD5:
65ac4562333712508fa94f0f7f0d162c
SHA1: c082dd32cb99ea5765c0c51c18f8928e27f02f0d SHA256: aa77ccb190749f33172d430941671448f787881c75d933e06a70c1863e0078d5 SSDeep: 48:Yt4C7myadiZ4BQGvPIzZjYNr3ptzdRMgAK6rc+QtllgYhdec/:IVCtd5wzZAr3pJdRMfRAkgdec/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | 1.99 KB |
MD5:
12c6fcc261d984b487461cfd79fb6a6f
SHA1: c3fb26e0dcfc6336ea926f838da55093898d7731 SHA256: 4030f3f7e4f309c3663a2e082607208d0739741174586d40d3137266a9b7ce37 SSDeep: 48:HCo025ZP0rWxAHXrQC0UN914hyZOIIoc7:v0YZP0rkA3rQsNHBZtc7 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | 8.76 KB |
MD5:
92d232900f65bb61d5dfd673cdbc1be2
SHA1: 2222533782516f3a55e9cfe45fe9af743a29a65b SHA256: eb154475bc47135df30ff30c0b15a977a1850c7e7c496eaf42b6369e65019e92 SSDeep: 192:hBcS4y+YdwMbajLVOqUHXQ6RegjH8fvtdC/POu/cR:hBL4yHGMbajLVOqU3vRfjcXtdCfER |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | 11.70 MB |
MD5:
052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021 SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry | 11.43 KB |
MD5:
7f3b4316e2f9da03f63c5083f9d80a64
SHA1: 278b84760a85f79b5e2f003054f48f25c2fc70ce SHA256: 0e0c0a11d3258218ceddb1ebe2ba724f785975689f1cd9b622ef1fc8bc25fb41 SSDeep: 192:gJwdDU6SDvnpgU1O+jMtTfGL2u7irTqsp4QlaqqZYsVI+6zal6FDZiusnsPSiGxz:gWdDU6SLpgU14eyzqQ4QlaqqCsVI+q6P |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | 16.70 KB |
MD5:
421ddf7a2881eb649ccb782744c95971
SHA1: 35920c8987bf62eddcf4a3bb9f82093c2a1b8a11 SHA256: 296d9cb50dc33c7354f0b046fcd7379ac9148fc979d4d42daad6899da1d1f46b SSDeep: 384:OwVWNRXOgVfkDz3cKd/EZWpWsDUQ4SF82y+I6FoLcfEbSLFeQ9:Ow0fllkzMC/E8MK8LSWIEuBR9 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | 30.60 KB |
MD5:
dae66c3b7dcd21ac51a8dee7f4601b31
SHA1: 7eef1f3c23e6b49b2412d82843a1e9cd9fd09a04 SHA256: c09648b74cdc5130cea6e530a9914300bfe49df52e35b41a70e0926883c1207b SSDeep: 768:UaOj0VTYQkV/ct88lztfxL3/U5vcMpmD7Tl+VjXk1/:tOj0VTJkVE7/xb85vcMa7hSXk1/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry | 2.04 KB |
MD5:
73ce4b1cc0967cfd97f86722174c0b4a
SHA1: c7bbd2959339ef6ea8bd4864cc24843ac08fc589 SHA256: 6aae85d49501bc1a2bcbf7d4a69371fd15f6ee37b4423fe737872400b8a69301 SSDeep: 48:Q1Ll0Si7hKs+Xo88fI8o7XRugLyq2oOlL6dyNmTujc/:Q8x8IKR5ahluQjc/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry | 8.60 KB |
MD5:
344c53e507381ccedf676c3d948194ca
SHA1: fd86a231c688ef84414f1a9f8c67c5b368ac9319 SHA256: 43275b81c4835ae4ea80791dda786a63fb0d22d67f370c3d2982819f8f5c6af7 SSDeep: 192:udW/uaJkoIAMmMaaW14eC/eqK5kEOsLsjGk04ZOXVEGz7nots7LPaxAJK+vYHb6f:uU/wnAMmgeSKu7sYD04U/zsePP8AE+Ye |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry | 222.21 KB |
MD5:
7e0c852430a2bf70d25030839ede90a7
SHA1: 3e3f5187aac640de592b42f8b67eb554b923df70 SHA256: 66ac8cf24602ba3ca86ceab1f5f61cc37625afe6f65a2e658168708a80cc4f8a SSDeep: 6144:zQXTi7IE70jNoV4ttS3fRMgGuHIB16aH0k:Gu7IYLVatS35MgjHsb |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | 20.84 MB |
MD5:
3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0 SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | 890 bytes |
MD5:
65b923effa2fca1d5b71abd9b7bdba5c
SHA1: 9ea56cd5b1c95de7ba68d97fe8099f94ecf47096 SHA256: f4389f1a4d6a52791eb2cad56f44e0e0a5f1bebfe1e312143e008de167d0727f SSDeep: 24:CKOiAiKnfK7lTwxGsAiKqHnM2mHkwqG0HtVc7:CpXiyy7lMYhjqHnMbEwqGuc7 |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decryptoperator@qq.com].cry | 848.75 KB |
MD5:
117ce9be2084cdf4de7a90c665b610f0
SHA1: 1747c7c2857dc2631a834a65e5997b20d2343841 SHA256: ac4e8c73c65ce188ac09715a735f04f565d2ca3819df911fa6cc59c574084ab7 SSDeep: 24576:jIfJQdG5nUrc0zrwZ/PPdkRcImmG0gP3Djbqx:0BQp6/PFygP3v+x |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry | 38.34 KB |
MD5:
d71f29a920dde31d1e49b48dac230c0b
SHA1: 83f75bf87817bd2afd7a98ef2e3401003e2e3193 SHA256: 398d5de967df2a3c3dd348a6705e4d5bd57f2c827f8934f38785fffba6e1d2da SSDeep: 768:UIy5L6BOpfuVsyU5t0pDbtocCUpUhYSdL5Qd2/ntoK+crqW5n6uI2df0lNUV:qL6EK25t0scVQ5Yc+K+cOmn1I2doOV |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | 853.75 KB |
MD5:
4d4c0625a337e0ddedfc767dc86468d1
SHA1: 727c6ecddd39ef4477fd5fbc9b17bb5613b3e8d7 SHA256: 492175950be0aeb7da9ad59213c49f0cd929d45edec143d915fb8758e82ae08f SSDeep: 24576:NXEqnhYJSsYMnHPEETl51zZB8nGDWlHYrBNo2hQ:6q+JSsHHdzcnde9NJC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry | 1.13 MB |
MD5:
990f5e4154075f685212e2427f04ac65
SHA1: 00aae015306f878143d85436db69cb7a97b72974 SHA256: e834de2005ebae093b579341e517f88a31d929557d55e428ce3c99167e39e9af SSDeep: 24576:pf9rBGp2+bscA9Eq6r1G/ju0n8ccM6bG1WrevdHMaWr15F9jGHAnmcgW:rBabsX9EqE66vX7ev4r116oJgW |
|
|
| C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | 18.75 MB |
MD5:
d0270fa686df7e1fbae95ad8489a5b5a
SHA1: 3d43a29d7087167d3f8e12ec237a8b25599cca07 SHA256: 677ba720e203d1ce322f4a4d6e6e9933c277afc51f1d336e6c7fdd7380a2c263 SSDeep: 98304:llyaDH9kcidg6C9NfjN0+inHftQADI0Ns:iaDH9F7/iHXDI2s |
|
|
Host Behavior
File (4545)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Windows\System32\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
2 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | desired_access = GENERIC_WRITE |
|
1 | |
| Read | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | size = 1048560, size_out = 129 |
|
1 | |
| Read | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | size = 1048560, size_out = 645 |
|
1 | |
| Read | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\desktop.ini | size = 1048560, size_out = 174 |
|
1 | |
| Read | C:\Program Files\desktop.ini | size = 1048560, size_out = 0 |
|
1 | |
| Write | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 144 |
|
1 | |
| Write | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry | size = 1072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 1696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry | size = 15072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 786688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry | size = 1952 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2640 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 596352 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2304 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 242 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 71248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 226 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 5568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 26944 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 37696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 27200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 9360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 67200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2368 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 4288 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1856 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 3200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 246 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 4208 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 6432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 16688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2000 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 5888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 816 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 6256 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 9504 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 20592 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1808 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 8736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry | size = 11472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 16864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 31104 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | size = 885776 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 1856 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 8576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry | size = 227312 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 2688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 8928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 656 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry | size = 39024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | size = 874000 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | size = 242 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry | size = 134864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 25248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 34928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 20640 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 33024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 19792 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 31840 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 960 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 43280 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 32608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | size = 786696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 27408 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 1936 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 29936 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 20576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1296 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 28608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2048 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1296 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 25120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 32416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 33280 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 32448 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 60736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 18832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5184 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 33568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2480 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 19488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 18416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5136 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1664 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 26416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1392 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 48128 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 44864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 11584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1600 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 16752 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 21760 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 37456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 37120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1680 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1344 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1440 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 868880 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1424 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 15744 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 19568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3984 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 31984 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 47968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 34176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 27184 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 415024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
2 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 21824 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 29312 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 944 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | size = 1744 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2528 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 18384 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1680 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 19536 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 33488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 44304 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 786696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 30176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 334432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 109728 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 72032 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 945008 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 42464 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2672 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 58032 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 416928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 123968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[decryptoperator@qq.com].cry | size = 169648 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 176 |
|
1 | |
| Write | C:\Program Files\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[decryptoperator@qq.com].cry | size = 720 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[decryptoperator@qq.com].cry | size = 252 |
|
1 | |
| Write | C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png | size = 262144 |
|
3 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 17264 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 28976 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 30960 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 34080 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 39520 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 29792 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 32160 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 99152 |
|
1 | |
| Write | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 18752 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 14880 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 6688 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 8112 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7696 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 11904 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 528 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 12704 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 321408 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | size = 262144 |
|
3 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3488 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 629680 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 12496 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 994192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 10608 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2608 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 15312 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5328 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4960 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7584 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 9040 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 64112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | size = 5040 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[decryptoperator@qq.com].cry | size = 576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[decryptoperator@qq.com].cry | size = 254 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 13264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[decryptoperator@qq.com].cry | size = 176320 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4896 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 8592 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 543312 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5376 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5024 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4400 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7664 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 38784 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 31120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 9264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3392 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3968 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3040 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4736 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5696 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 6992 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[decryptoperator@qq.com].cry | size = 2560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3136 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 20592 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 438192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[decryptoperator@qq.com].cry | size = 6816 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 323952 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 320400 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 264112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 241040 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[decryptoperator@qq.com].cry | size = 606064 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[decryptoperator@qq.com].cry | size = 1392 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 302992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 73088 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[decryptoperator@qq.com].cry | size = 1920 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[decryptoperator@qq.com].cry | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 712608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7088 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 14432 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1600 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 10848 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 280464 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 1840 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7984 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3760 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 430096 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 27872 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 26336 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5840 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2768 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7376 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786692 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7552 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 6640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3024 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 9248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2352 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 209440 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 6064 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3424 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui | size = 2112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 6640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 8496 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7680 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2032 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7808 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 419248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4304 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 2496 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7808 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 52672 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 20960 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 3232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5008 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 198064 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4816 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 154464 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 5008 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 862624 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 28960 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 26896 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4880 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 55696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 250 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 11648 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 16128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 41872 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 17248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 16192 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 16688 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 11664 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 22528 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 26752 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4928 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 339872 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 252 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 105360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 744896 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 43424 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 442288 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 900000 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 342976 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL | size = 1012656 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 15808 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 15808 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 15808 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 451488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 537520 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 55760 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 297376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 691632 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 385376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 502176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 318384 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 518992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 138624 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 786682 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 4080 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 48000 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 24336 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 24784 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 157040 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 47792 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE | size = 40208 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 204176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 20560 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 14544 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 13520 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 7968 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 15744 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786682 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 12992 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 20464 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 20192 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 8784 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 9712 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 786688 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 14496 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 11072 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 18320 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.id-9C354B42.[decryptoperator@qq.com].cry | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 473968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE.id-9C354B42.[decryptoperator@qq.com].cry | size = 236 |
|
1 | |
| Delete | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | - |
|
1 | |
|
For performance reasons, the remaining 3296 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (8)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 83, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe, data = C:\Windows\System32\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe, size = 170, type = REG_SZ |
|
1 |
Process (1341)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\cmd.exe | os_pid = 0x9b4, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
1314 | |
| Enumerate Processes | - | - |
|
26 |
Module (135)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x76c20000 |
|
1 | |
| Load | advapi32.dll | base_address = 0x74d40000 |
|
1 | |
| Load | user32.dll | base_address = 0x74f40000 |
|
1 | |
| Load | Shell32.dll | base_address = 0x75fd0000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77130000 |
|
1 | |
| Load | mpr.dll | base_address = 0x74b50000 |
|
1 | |
| Load | ws2_32.dll | base_address = 0x75bc0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
16 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe, size = 32767 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcAddress, address_out = 0x76c31222 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleHandleW, address_out = 0x76c334b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindNextFileW, address_out = 0x76c354ee |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindClose, address_out = 0x76c34442 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MoveFileW, address_out = 0x76c49af0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileSizeEx, address_out = 0x76c359e2 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x76c34950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileAttributesW, address_out = 0x76c31b18 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExitProcess, address_out = 0x76c37a10 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x76c35223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameW, address_out = 0x76c3dd0e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameA, address_out = 0x76c4b6e0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateMutexW, address_out = 0x76c3424c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenW, address_out = 0x76c31700 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenA, address_out = 0x76c35a4b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcess, address_out = 0x76c31809 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForSingleObject, address_out = 0x76c31136 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLogicalDrives, address_out = 0x76c35371 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetTickCount, address_out = 0x76c3110c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteFileW, address_out = 0x76c389b3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WideCharToMultiByte, address_out = 0x76c3170d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Sleep, address_out = 0x76c310ff |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LeaveCriticalSection, address_out = 0x77152270 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReadFile, address_out = 0x76c33ed3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateFileW, address_out = 0x76c33f5c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenMutexW, address_out = 0x76c35151 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EnterCriticalSection, address_out = 0x771522b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForMultipleObjects, address_out = 0x76c34220 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiW, address_out = 0x76c4d5cd |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiA, address_out = 0x76c33e8e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteCriticalSection, address_out = 0x771645f5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReleaseMutex, address_out = 0x76c3111e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CloseHandle, address_out = 0x76c31410 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersion, address_out = 0x76c34467 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateThread, address_out = 0x76c334d5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExpandEnvironmentStringsW, address_out = 0x76c34173 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceCounter, address_out = 0x76c31725 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceFrequency, address_out = 0x76c341f0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcessId, address_out = 0x76c311f8 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFileAttributesW, address_out = 0x76c4d4f7 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVolumeInformationW, address_out = 0x76c4c860 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WriteFile, address_out = 0x76c31282 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFilePointerEx, address_out = 0x76c4c807 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetEndOfFile, address_out = 0x76c4ce2e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindFirstFileW, address_out = 0x76c34435 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcessHeap, address_out = 0x76c314e9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapReAlloc, address_out = 0x77171f6e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapAlloc, address_out = 0x7715e026 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapFree, address_out = 0x76c314c9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreatePipe, address_out = 0x76cb415b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetHandleInformation, address_out = 0x76c4195c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x76c3103d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringW, address_out = 0x76c33bca |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringA, address_out = 0x76c33c5a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenProcess, address_out = 0x76c31986 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = TerminateProcess, address_out = 0x76c4d802 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetSystemTime, address_out = 0x76c35a96 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SystemTimeToFileTime, address_out = 0x76c35a7e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLastError, address_out = 0x76c311c0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateToolhelp32Snapshot, address_out = 0x76c5735f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32NextW, address_out = 0x76c5896c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32FirstW, address_out = 0x76c58baf |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegOpenKeyExW, address_out = 0x74d5468d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegQueryValueExW, address_out = 0x74d546ad |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegSetValueExW, address_out = 0x74d514d6 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegCloseKey, address_out = 0x74d5469d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenProcessToken, address_out = 0x74d54304 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = GetTokenInformation, address_out = 0x74d5431c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenSCManagerW, address_out = 0x74d4ca64 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenServiceW, address_out = 0x74d4ca4c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CloseServiceHandle, address_out = 0x74d5369c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = ControlService, address_out = 0x74d67144 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = QueryServiceStatus, address_out = 0x74d52a86 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumDependentServicesW, address_out = 0x74d41e3a |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumServicesStatusExW, address_out = 0x74d4b466 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x74f590d3 |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExW, address_out = 0x75ff1e46 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQuerySystemInformation, address_out = 0x7714fda0 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetCloseEnum, address_out = 0x74b52dd6 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetOpenEnumW, address_out = 0x74b52f06 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetEnumResourceW, address_out = 0x74b53058 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = WSAStartup, address_out = 0x75bc3ab2 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = socket, address_out = 0x75bc3eb8 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = send, address_out = 0x75bc6f01 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = recv, address_out = 0x75bc6b0e |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = connect, address_out = 0x75bc6bdd |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = closesocket, address_out = 0x75bc3918 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = gethostbyname, address_out = 0x75bd7673 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = inet_addr, address_out = 0x75bc311b |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = ntohl, address_out = 0x75bc2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htonl, address_out = 0x75bc2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htons, address_out = 0x75bc2d8b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x76c4d650 |
|
16 |
Service (78)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 |
System (249)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = XDUWTFONO |
|
1 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
25 | |
| Sleep | duration = 100 milliseconds (0.100 seconds) |
|
8 | |
| Get Time | type = Performance Ctr, time = 15393457807 |
|
1 | |
| Get Time | type = Ticks, time = 97625 |
|
3 | |
| Get Time | type = Ticks, time = 98155 |
|
2 | |
| Get Time | type = Ticks, time = 98327 |
|
2 | |
| Get Time | type = Ticks, time = 98499 |
|
2 | |
| Get Time | type = Ticks, time = 98951 |
|
2 | |
| Get Time | type = Ticks, time = 99435 |
|
4 | |
| Get Time | type = Ticks, time = 99762 |
|
2 | |
| Get Time | type = Ticks, time = 99996 |
|
2 | |
| Get Time | type = Ticks, time = 100371 |
|
2 | |
| Get Time | type = Ticks, time = 100714 |
|
4 | |
| Get Time | type = Ticks, time = 100839 |
|
2 | |
| Get Time | type = Ticks, time = 101026 |
|
2 | |
| Get Time | type = Ticks, time = 101244 |
|
2 | |
| Get Time | type = Ticks, time = 101915 |
|
4 | |
| Get Time | type = Ticks, time = 102133 |
|
2 | |
| Get Time | type = Ticks, time = 102445 |
|
2 | |
| Get Time | type = Ticks, time = 102679 |
|
2 | |
| Get Time | type = Ticks, time = 102789 |
|
2 | |
| Get Time | type = Ticks, time = 102929 |
|
4 | |
| Get Time | type = Ticks, time = 103335 |
|
2 | |
| Get Time | type = Ticks, time = 103553 |
|
2 | |
| Get Time | type = Ticks, time = 103881 |
|
2 | |
| Get Time | type = Ticks, time = 104021 |
|
4 | |
| Get Time | type = Ticks, time = 104271 |
|
2 | |
| Get Time | type = Ticks, time = 104645 |
|
2 | |
| Get Time | type = Ticks, time = 104941 |
|
2 | |
| Get Time | type = Ticks, time = 105191 |
|
4 | |
| Get Time | type = Ticks, time = 105565 |
|
2 | |
| Get Time | type = Ticks, time = 105846 |
|
2 | |
| Get Time | type = Ticks, time = 106111 |
|
2 | |
| Get Time | type = Ticks, time = 106252 |
|
4 | |
| Get Time | type = Ticks, time = 106392 |
|
2 | |
| Get Time | type = Ticks, time = 106657 |
|
2 | |
| Get Time | type = Ticks, time = 106860 |
|
2 | |
| Get Time | type = Ticks, time = 107016 |
|
2 | |
| Get Time | type = Ticks, time = 107125 |
|
2 | |
| Get Time | type = Ticks, time = 107235 |
|
2 | |
| Get Time | type = Ticks, time = 107344 |
|
4 | |
| Get Time | type = Ticks, time = 107469 |
|
2 | |
| Get Time | type = Ticks, time = 107578 |
|
2 | |
| Get Time | type = Ticks, time = 107687 |
|
2 | |
| Get Time | type = Ticks, time = 107796 |
|
2 | |
| Get Time | type = Ticks, time = 107905 |
|
2 | |
| Get Time | type = Ticks, time = 108030 |
|
2 | |
| Get Time | type = Ticks, time = 108139 |
|
2 | |
| Get Time | type = Ticks, time = 108420 |
|
4 | |
| Get Time | type = Ticks, time = 108529 |
|
2 | |
| Get Time | type = Ticks, time = 108639 |
|
1 | |
| Get Time | type = Ticks, time = 108654 |
|
1 | |
| Get Time | type = Ticks, time = 108748 |
|
1 | |
| Get Time | type = Ticks, time = 108763 |
|
1 | |
| Get Time | type = Ticks, time = 109185 |
|
2 | |
| Get Time | type = Ticks, time = 109403 |
|
2 | |
| Get Time | type = Ticks, time = 109575 |
|
4 | |
| Get Time | type = Ticks, time = 109684 |
|
2 | |
| Get Time | type = Ticks, time = 109793 |
|
2 | |
| Get Time | type = Ticks, time = 110058 |
|
2 | |
| Get Time | type = Ticks, time = 110277 |
|
2 | |
| Get Time | type = Ticks, time = 110635 |
|
4 | |
| Get Time | type = Ticks, time = 110776 |
|
2 | |
| Get Time | type = Ticks, time = 110979 |
|
2 | |
| Get Time | type = Ticks, time = 111135 |
|
2 | |
| Get Time | type = Ticks, time = 111400 |
|
2 | |
| Get Time | type = Ticks, time = 111571 |
|
2 | |
| Get Time | type = Ticks, time = 111790 |
|
4 | |
| Get Time | type = Ticks, time = 111915 |
|
2 | |
| Get Time | type = Ticks, time = 112024 |
|
2 | |
| Get Time | type = Ticks, time = 112570 |
|
2 | |
| Get Time | type = Ticks, time = 112882 |
|
4 | |
| Get Time | type = Ticks, time = 113241 |
|
2 | |
| Get Time | type = Ticks, time = 113381 |
|
2 | |
| Get Time | type = Ticks, time = 113490 |
|
2 | |
| Get Time | type = Ticks, time = 113615 |
|
2 | |
| Get Time | type = Ticks, time = 113724 |
|
2 | |
| Get Time | type = Ticks, time = 113833 |
|
2 | |
| Get Time | type = Ticks, time = 114130 |
|
4 | |
| Get Time | type = Ticks, time = 114239 |
|
2 | |
| Get Time | type = Ticks, time = 114348 |
|
2 | |
| Get Time | type = Ticks, time = 114504 |
|
2 | |
| Get Time | type = Ticks, time = 114660 |
|
2 | |
| Get Time | type = Ticks, time = 114769 |
|
2 | |
| Get Time | type = Ticks, time = 115035 |
|
2 | |
| Get Time | type = Ticks, time = 115362 |
|
4 | |
| Get Time | type = Ticks, time = 115487 |
|
2 | |
| Get Time | type = Ticks, time = 115690 |
|
2 | |
| Get Time | type = Ticks, time = 115986 |
|
2 | |
| Get Time | type = Ticks, time = 116220 |
|
2 | |
| Get Time | type = Ticks, time = 116376 |
|
4 | |
| Get Time | type = Ticks, time = 116485 |
|
2 | |
| Get Time | type = Ticks, time = 116938 |
|
2 | |
| Get Time | type = Ticks, time = 117250 |
|
2 | |
| Get Info | type = Operating System |
|
2 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\syncronize_2DWHU4A |
|
1 | |
| Create | mutex_name = Global\syncronize_2DWHU4U |
|
1 | |
| Open | mutex_name = Global\syncronize_2DWHU4A, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\syncronize_2DWHU4U, desired_access = SYNCHRONIZE |
|
1 |
Process #2: cmd.exe
246
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\Windows\system32\cmd.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:33, Reason: Child Process |
| Unmonitor | End Time: 00:00:57, Reason: Self Terminated |
| Monitor Duration | 00:00:23 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9b4 |
| Parent PID | 0x9a8 (c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9B8
|
Host Behavior
File (182)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
5 | |
| Open | STD_OUTPUT_HANDLE | - |
|
25 | |
| Open | STD_INPUT_HANDLE | - |
|
69 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
60 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
4 | |
| Write | STD_OUTPUT_HANDLE | size = 63 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\mode.com | os_pid = 0x9e0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Create | C:\Windows\system32\vssadmin.exe | os_pid = 0xa18, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\Windows\system32\mode.com | type = PROCESS_BASIC_INFORMATION |
|
1 | |
| Get Info | C:\Windows\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\Windows\system32\mode.com | address = 8796092887040, size = 896 |
|
1 | |
| Read | C:\Windows\system32\vssadmin.exe | address = 8796092878848, size = 896 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x76f50000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x49de0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x76fa14a0 |
|
1 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-16 14:46:19 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 97999 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15520777306 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Environment (25)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
8 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
3 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
3 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
2 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000000 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #3: mode.com
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\mode.com |
| Command Line | mode con cp select=1251 |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:34, Reason: Child Process |
| Unmonitor | End Time: 00:00:36, Reason: Self Terminated |
| Monitor Duration | 00:00:01 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9e0 |
| Parent PID | 0x9b4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9E4
|
Process #4: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:36, Reason: Child Process |
| Unmonitor | End Time: 00:00:57, Reason: Self Terminated |
| Monitor Duration | 00:00:21 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa18 |
| Parent PID | 0x9b4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A1C
0x
A24
0x
A30
0x
A38
0x
A3C
|
Process #5: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:45, Reason: RPC Server |
| Unmonitor | End Time: 00:04:23, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:38 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xabc |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
AD8
0x
AD4
0x
AD0
0x
ACC
0x
AC8
0x
AC4
0x
AC0
0x
ADC
0x
B54
0x
4F0
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-16 14:46:28 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 106860 |
|
1 | |
| Get Time | type = Performance Ctr, time = 16602573770 |
|
1 |
