cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
Windows Exe (x86-32)
Created at 2019-06-27T18:45:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
3536
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:28, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:32 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa54 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A58
0x
A5C
0x
A60
0x
A64
0x
A94
0x
B2C
0x
B30
0x
BD8
0x
BDC
0x
BE0
0x
BE4
0x
BE8
0x
BEC
0x
BF0
0x
BF4
0x
BF8
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | 0x012A0000 | 0x012B5FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | 71.00 KB |
MD5:
e59ffeaf7acb0c326e452fa30bb71a36
SHA1: c88fad293256bfead6962124394de4f8b97765aa SHA256: a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2 SSDeep: 1536:zkGB8nHbKUvryElSpi8jCZGcqDKlKnr8dV+99rmuoENA4Cj:zFBMHRvrAjCZmKcnr8YrfA4Cj |
|
|
| \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | 386 bytes |
MD5:
c0012f5b2eb1a0ac3f402cda73a5f77f
SHA1: d56626be75b165b84a2513b284e4e98d5af6f808 SHA256: 18ad828347e483bc3bef71c302999ad3cb8b7e4158db9b1cd444c972907473ef SSDeep: 6:N+OT/5TaGhOrqDGpcLk74zFlDFPuAPbnRCIHrNi+z4tLX7SgbHarjHzRVQg2d7Qj:sko7fpcvzf8ATUIL6VSugjVmgYQr5Deo |
|
|
| \\?\C:\Boot\BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | 64.25 KB |
MD5:
ec092ff24789125ed65c970b0cbf9196
SHA1: 2e118d2e75d96db5df9533783c8b3aa90d394703 SHA256: 32bc5d3056627654c1793835a59d5cc64f48b99df57ef99bf31c41cc2b9d8562 SSDeep: 1536:b6tZ1HYW3WpOncFKo7djeZQsS+wPCivPM3/PWxursEWzKYBGfwe:b6trDm4ZQsSrC/36ub0KYMv |
|
|
| \\?\C:\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute | 8.25 KB |
MD5:
20fcc02037d5dc0638bc5cea2a04914e
SHA1: 2e5c4e73267c4b590eafaad8d76d87e75493443a SHA256: 4b81a9920f92a6e2fad883994da640a3537b2516b3310563cd36cfba666d64f2 SSDeep: 192:Iq1fVRBXKQO0G66fVwD42JH5mFLzAV/y+vBYq2tPj:IA/Fa0EVobZmlkdyqsr |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.77 KB |
MD5:
d213b7bd0b34376ec9fae21da8bc3def
SHA1: c9f43c8df36ec10cd8cdc48e8223f0251a64c4ad SHA256: 83ecd869b0b5c942c4fc7b4fa6606c6c863a4bf277cebdcd1b649a0f72bc5c15 SSDeep: 48:DziycjHncPFCt2u7brbhYm/zkfy+NsPsIXlvF9:DziycbyFC9brVDwfy+eTxF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
bf0c76d45538208bdf224d69209d2daa
SHA1: 620bbad2b461e05c93388b2c876b4734870d6104 SHA256: 587ee2e03cc216584f240116064a8d7a52ebd98de54d7f4c7b95c7c61e08a916 SSDeep: 48:aRzvYLlPGY8NV/TVuI0nDtB0G91mhbvFsl:ow/gTqBuG91wFsl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.08 KB |
MD5:
6bff977392feabc94b53462daa9a40df
SHA1: 38dd6d5e6fae60e4d02ed805fa7a47b11b112463 SHA256: 453b31ac77b83039d672d32ef6a0975892f6ac99a52edefb7eb1e845b97b4857 SSDeep: 48:Paa4aS9D5PYniY4Xh2j4oFMbhTzID0rRX4RogOQ/JY9oe3RcFsNPIvJvF9:PataYw4Xs4o6hTTNougb/oouc0P6F9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.49 KB |
MD5:
3c1daf90afa598a2599a22a18f38b100
SHA1: 67b7c031dd3d251dc1d9001853162804fa31a04a SHA256: ffff9312f1baa7e9eb06f88db82ed156d45fa55c23a9f6c5b16f50d61ca1ee8f SSDeep: 48:GqObcPAxNZ7Ig1UE4nQnTEy7Dh+f3+G62adM3u6WwYd09QRHmvF9:qc+NZF1nTK3+B2a/d0i0F9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.36 KB |
MD5:
b18c223c6d9f3c5908837dc77cf3c4ff
SHA1: a24c2697de8e5e12abcda1a3785b5cbbb0507f72 SHA256: 357b59daa382ccbcd305dd1dd2f0107cb595f1d7e125726244144bcde889b7b7 SSDeep: 96:LQHBoowNjPTkHAQPSspUUG/ep/i7MVSzxXGiP2F9:khoPzl2G/p7aKx2s2j |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.35 KB |
MD5:
d177ccde372df029dc7016aff7dc8601
SHA1: 58589eb23e559290ae4106f650f859bebf379cff SHA256: 08475b058d47e2e2af3fdc5dda274c66821dbb5e478812803776def3eb48ca83 SSDeep: 96:oUHpjOtBZymJcvHNpeQxpXMLQ8/H7wBSK8mUjcsWQO9pjVICxzbBgS1pwF9:oUJjmynvbbxpXaHySK8mUIMO99rpNMj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.61 KB |
MD5:
6e2ce24ea6f94af15b6b19e35adbadfa
SHA1: 969ff07bf5c3abf72c52ca7aa289b90e2cd715a6 SHA256: da56abd685c47b0b233f141445f2d3286235d90d1cc0e41966875930a9817083 SSDeep: 48:CGmRobD9x0+KT4J7/dcVhSfjymqLS+XK5pQBXoe+bbUM9vRGoJSamrpvF9:4mA4ZdcVkfOmq+ieRJbUyRLwJVF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.00 KB |
MD5:
0d09fc387c34d8a282f04c0a26032bf7
SHA1: 1bd17f3e2d2f15e59839ded8ac0746b0cfdf9f06 SHA256: a96277db59b5fa5f7819231dcd1afb2b52338c43d400c908d02f28c23f5d32c1 SSDeep: 48:c2LgcSrvLVn2iwtRsisRH7Ny59k8fpVAgsgch5SR66KtNqxvF9:ucsJ2Zhy7o59kkpjK/S4xtoF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.56 KB |
MD5:
9ffb2967d2899059545f5aa77c6383a7
SHA1: 43539763f87f6e553fb24d2bf7b31f663feda248 SHA256: b49a59b4aef84206ea8dd36cc89592c190ef5849b5ed785c2ec9eab6f179b8b6 SSDeep: 48:70ND8+KzhsislhkamIYwp6vo+DRZlWWS0vF9:gSphsiO2jTNF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
05bb4649c4c61e9ade2282bfef09ed69
SHA1: bb0958c6c368158ef07a4390ae80c67705c1d19b SHA256: d77f30fe380b21b7b4fa1072a61f8ad09697813c914d57c09915308512505980 SSDeep: 48:Q0jFlXOy+vKKnY8qjTYa0FsW/27Qn7DxjjizvF9:Xn+yKY8qHQDx4F9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
1313628002e35cdf0ea03dd232b3b0a7
SHA1: 83f93092a299910357ffb12517493b4ec9100fe6 SHA256: 2d7843b238999cf007205425799125489cd467f1dc6918d344e3908bb4c3562b SSDeep: 48:5tSsgJqL5Q3hIhDwBJllNykPYJmpS6pUvF9:F8qlQIaBznzgJm/EF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 16.94 MB |
MD5:
2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07 SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4 SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
32110a59fef0f4c48f0813952cbe6bc7
SHA1: 06fc4cebfc7354661116402afa0c270801afd1c9 SHA256: bd31484045ed792f5a40185d74e27b97f7f5ff27d3bab675f1c4c9d532caef3a SSDeep: 24:mYl4ALr04EO+QIHFge6p7HGCeOiRcap3I5WFAjS5cTz1U+f2gMeuoYuk9Sz2M1Cw:vl4ALgxTltkilNI0FAjSAfDK66VrvFsl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 5.99 KB |
MD5:
83145f647d4efda069e666f8f6e75b33
SHA1: 239405f14071cad9ab23e73da81d5aefdb9ceded SHA256: 53d24ccfa1c34c1a1a3475dfe395f494113a505529e265c9555c11a590a3ceb1 SSDeep: 96:lw19Kc7o6tq8Dttrj3mj/wbODtCGxapBMcjqbDF3gc7ZZk4+d4im3D0e18vXk69R:lA9Kc7oq5DD6j/SO7M/q/Vgc7ZZtloeM |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.60 KB |
MD5:
da2283edfa63d65554cab5fc603621c0
SHA1: 59ac7b6ff13ab925583a052dab33199e2cc60321 SHA256: d9e78b4cad27b5de967a2a834911b16699af2036d8526be0be88df953ef96a82 SSDeep: 48:HWE3YeDrkn8H/nlU46e4zMCVafZsvGy4pvF9:25ePPHOzrVaRkG3F9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.55 KB |
MD5:
d4fc6cc708f8ed7f5ccbe254e62f3d94
SHA1: 227c7717dd970a0e469dbcc7911e26af595aaee2 SHA256: a945201e3592f9c6bc235602b4a8c304c8881ee4494664a1e718b7d6d53da532 SSDeep: 48:vzYF0sg9RJShxcn34UwMvnl4o/Yx58qtvkaMeyFj93cf2FHHdYlMkdpGiiKU59Cj:rB9XShxcn34rMvzwj8q1kaM1j9302Fm7 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.44 KB |
MD5:
ce8728303f39f34515ee9775033a16c2
SHA1: 5ca6da0f48b4e83144a4bff64b2582a31570485c SHA256: 95e09cbede84ddff5f1ff1938fc7e17617b42d436ba17c551bc8bbda5068b635 SSDeep: 24:BVypmHWb41B2XDOIgb/D4xP3HcdgZzjaZ+00jvrdVRCLwK0zpTf0RVbVoQFKo:BUmHcW2XDONOP3FjXvrdqLc+VbvF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.03 KB |
MD5:
b9e47dc30ddf6b3fe7562ca4a2cf5c3c
SHA1: 760d378348639730947eaac023e229e45d8cc3fe SHA256: cc8b5c7b13b2eb361a90b81e18125ed6cba629eade1ed9d1d6f3dced1d1d7e86 SSDeep: 24:XiaCcPn7xkaPRvghhfWEHIPu7HlIbHy4Gq3i0jX/3XSpbGDI0VoQFKo:X9CcjxkSv4gEHSu7Tnq3iYXPlvF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 9.52 KB |
MD5:
2ba87bbd4a6df5e0e6656f3b49a4c853
SHA1: 67455df2581878e768368b2c7290b0b0cfa2522e SHA256: d9e826898039975ea2093c83115df2ffdf808b09b1c40b38ff1cbd843f9f204e SSDeep: 192:+KV2pA32Tl3T3WF+EapbTxFG7ttUEudEkgVTttX68OTLgZf9+PG8j:nV2dTxYCPxEptxuxgB7X68O3gaOg |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.81 KB |
MD5:
bcc358b5f1caf550d52836554e1126c3
SHA1: 5789b7206546dca701880a0dc639c73a1c8e9ddb SHA256: 569924934b6bd8754decf326b6afd1658583f136bd501e01d205310534b199e6 SSDeep: 48:aCam5ZEiGOBSAlCq7sKBTC4wWjoHoRnDYzHsAZ6FvF9:fam5Zl8AltLTCtSFnDYDsAZ6BF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.14 MB |
MD5:
ace231d527bd799d7dc830f68796223c
SHA1: edefa4dac428f42c17ac3fc187367202bc3f3643 SHA256: 720e495f0fa6db72c7b0d0ec1a7ea57ae3884402a6624493c2616697c4d4d44c SSDeep: 49152:zDxL8QBo0Tex4S120ytJy78GJK2pIsOHLLWe4k3:zR89t1rJDpIsiLLh4k3 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.05 KB |
MD5:
8297198428d3c0455c4877c35d6e0931
SHA1: 403329b3b34087d99997cc3b9b7cff9ca0c913e0 SHA256: f5f4383f736c604c60f8301a29155307b646f46b528bd21f30bc6b5d273ad281 SSDeep: 48:1WtqaC0ggdo0fDXPgci0dSigoe9+wvA+hngJfoilNkuvF9:byo4xiytO+wvLwZ5F9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.19 KB |
MD5:
4933fcdb12004e9aff9bf2500e15ceb7
SHA1: a497d4a938389668fc7057dba65dc3730aeed9a6 SHA256: c15ecab7fab16eb17f5d7257e63a55a3e194db4218bb5c0c906178f9503c45a5 SSDeep: 48:EdNukdsFKqzBJ8RkKtnFw9ilPzCHcvL6uVs9Ez4xj05cAeHhmUp23GMgtvF9:EdWzARkKtnF9xzQm6uVsez3uAiMUp234 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.66 KB |
MD5:
77ab322bc39034a195d7eb58c14a4e0c
SHA1: 49f0a3932994bd76b0d3d410a21886cd9c360018 SHA256: 0aae51bf8feb96be11cac1d1283d46e1b6e9e8353f05e45a1e3efa6ea8ec2d57 SSDeep: 48:CVWR4518Zptrq7JD9dZxKWfcp39O2a+dhPvF9:Ck4519ND107F42a+dJF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.08 KB |
MD5:
877629dd0e08bbc5cb45f7b49b527ffc
SHA1: 658884096244e756e610ab7b7d6190c5c7876778 SHA256: d8ea845b152493f8a59383dffe4312d67db82a07bd404054b389f485571267ba SSDeep: 48:jmJQSVFSKKDqxcOjT3W79SLb55YXHtiv3xt0Kbcw0vF9:CieSNqGOjTiuFSXHtiv3xqKIwOF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.14 KB |
MD5:
190d146ca0d097fcdac758405be2bb69
SHA1: 1b6fc1a50fe85633622a5ba112f42876bdd6d52d SHA256: 79b86e6b14d5cff6d976dc3f93dec90b7da10ee64e0a7c4075fe6b7cbbe0e55d SSDeep: 24:FHzBm492jr98PgV0lg28lYGAWfzyZpZOwtHYWkPnB1oiI06IVoQFKo:FHzoOEegul4lYGhzuKgHY71rtvF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.66 KB |
MD5:
0bb637851cee6b344cf78627914b0f36
SHA1: f338cdba62a27288bfbe75cd98d0dc8a9234d864 SHA256: 85273bbff012466ecb12046997efd9a672a501480b179fe399b10469915019be SSDeep: 24:92wXTwRWcF6n49NEwPZsymtmfbaFMhRVKNoXkER2HIlS6w9Imb34kVoQFKo:cwXTQGn4XP5Omj5X0Il7mckvF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 582.61 KB |
MD5:
1b068138b3383783c4d0b21343abc7f0
SHA1: f0d75756b63ce65b373ce4fd8dd8e8fb21620ae7 SHA256: d9af217db8175c4a5c0d6c56361dc4da082ab0908445d7bab796988a2e4629b0 SSDeep: 12288:4zAJbj2duMacA+aaBFuRyq8HtFoGUhqu2GS63b:4s5241tXaBEQqoFoGUhv2N4b |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.14 MB |
MD5:
3f82f252f34bf0cc59de38d8f290483d
SHA1: 17f6d4f289610b4d53fd12f65034ca7b7a1438b0 SHA256: 4ea2f4caafdf21800c9a76d667bd47c631efb3a34d582c13e4179ba0765437ba SSDeep: 49152:zDxL8QBo6Tex4S120ytJyGdyWPATWmMrGzEybPUuZ:zR89j1GrwmMzd |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 5.67 KB |
MD5:
234e3b6828412b6d8ab4f44a9c31389b
SHA1: 73ea2563436a2dad35fa9338c2a4c3844edc5ea8 SHA256: 57242003ca91facff1f422a3414242f1c88dc5c86d0bffe941ba8cb3ff47d441 SSDeep: 96:3adK/tDXvqypCukoVMEBA5JyfsM6fuS2YnoS0PSBuQ5DIFA67C+zSoH3WvOgeNYL:5/tXvqyp3SGSLCbS4S0QyFAnSSIDhuFj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | 26.80 KB |
MD5:
7e15ba69e4c61aa4488c1585ab48669f
SHA1: e08c90cdef52aebc5d3c74a7410c510951b6a3b0 SHA256: f36f85fca7b682cab5de16528ef1799ec69aa2274ed1b71448868f7f146dc6b3 SSDeep: 768:vGsb2A0JuyDpstlCBchx9JMHJJ4wI4UFzYrApsZE:OFuyDwCcx9JiJ7UFzY0j |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | 65.86 KB |
MD5:
b57b4cf2c7e153feca9af977a2d73644
SHA1: 0380633470197b9bc910d8df26dd25201986c20c SHA256: fc3bbed8f7d9f29fcb656dce2014e78628913a5ca3671cbbf18ca14e922fb278 SSDeep: 1536:IAsFDLFuRyIw4S2T3iPe3wKhbpFY3dXXfsQo:euYD2GehhFqFvsd |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 9.38 KB |
MD5:
9c90d85ff4141acfa889ba1c7ef3b29a
SHA1: c80407b1e386f53e8f8e9b2a41d7984c118b85b7 SHA256: 90ed54fb5b7607f47404256f7f58ae13b3f659914bc15541913b8778a48dd767 SSDeep: 192:EtlJ8A8Y9oWlYb42PK0YcZZybiOODq4vqPT9SAWAU6j:sN8Vlb7PKPMexv9Sp1u |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.06 KB |
MD5:
70eda13c18cf854535a24be446dc099f
SHA1: 21b45fdb7b9bd5e9d6b584d2d31556f715ffcf92 SHA256: 83c80367a702b87930e328ef9030b70d8fc5821aa1dbf4304546798a924133aa SSDeep: 24:NrQiVdYYdHMtFCmzW6HBw9J4N3Y7vclDB2gRQekSo8Ex9aWFhd8fYuVoQFK/l:ii8YdstFCn6m9J4livLgKzrog8fYuvFY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.06 KB |
MD5:
45dddaeabf9c886e999779299b4a9ab4
SHA1: 661b418ac70830625ad7e742ee46cf7da54d1e8e SHA256: caa22264e665fe29ec6fc97988cb5892f4f3b58263c49b34619d2650ffa254c2 SSDeep: 24:yl3K7+mwOwKqelL8BC9PzWX4fl+aB8xvmdKDjA5IqIjOVoQFK/l:yrmwOLluC9PzWX4dBB0eQnA5IYvFsl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.81 KB |
MD5:
c1a30942d7488e276aee879c38090572
SHA1: 6e1c7f03d0dc721868175299351376aaee149460 SHA256: 1816af64879d1240450cf4b8b8bc3b9607f7914ed25e324d7049f55c4e26e48f SSDeep: 48:33NslPidVpvJvIzWTO4kZX8v0hk4KGR6VMyDtADdVzc/n2vdyGcX6c/CMvF9:33WRidVpvyWT2s5sR6Vhtk/zc/GB0laa |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.42 KB |
MD5:
399580c435c5c2fff5ed0155809e3883
SHA1: cec8e12f5d38b09b23fcfab4b851b7e953d58cda SHA256: b41b6659ed1fda310e7c0bb46cc213b622e571936d4d7be0f8b93ca313380b20 SSDeep: 96:aUGBlNgSR0tmAJpKwqG43RnZko/Ca5/Cqovp3eF9:aPBlNp0YheEBvFCqovp3ej |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 582.61 KB |
MD5:
4260733efbfd7871aaf7d26bed2ff67c
SHA1: 70d7b0e363c48c77082ac65055b3077fb2c9b001 SHA256: f5d5ebdb0fce6306db93155758e444f6ec5d43bfa5c1296c68e26daf166b3bc2 SSDeep: 12288:ZFKq+qc5xVdug4v//GgeLH4YkFZ63Oret6YsuuSqo:ZwPJ7duZv/ePjpkG3Os6YsvS7 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 16.71 KB |
MD5:
589a5c2eb4fbf9b91028599be8479161
SHA1: aed90aca1b825cfbab2d7018267b282150697b59 SHA256: 83dc27d6cb8b87e74db18a8dcba2ef743349e4bb0924e3b53b0fc86f20c54acd SSDeep: 384:6NGx3IJYC96gPZ7zynIIGI5seP7cxW8KODicxh:6kxYGC93vyIMiejXONxh |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.42 KB |
MD5:
e0b7e64ded67a1029e9383f366c581a2
SHA1: 6ab935f4083038fdec4e3704b1b837700c47b470 SHA256: 02b512bea781ed36491629273e31e170848452518dc7e9dad30ab4fa876bb375 SSDeep: 96:m4oGk3pvfkHnJX1uzjWUsMjEmJ4ssq7SIs/bmww4+p3iHAhlpi4Ux1XYWYTF9:mN1vfkHnJFYjWQYwiqGIsKww/FiHgDUW |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 6.52 KB |
MD5:
cdb9da52ccfd02dd61ac350448923dce
SHA1: 278830e90655b71814fd10006b4cc9c5799ae7c8 SHA256: 229ccd70aa0791b8c687df0d4dd2505c8156534f6bf08dd64823708ad5a68191 SSDeep: 96:3NEJxMOs5pH86cIzDoCy5lzdppbmQY2Fs9qXOsBx9DCh+7B4FIe1/m3nsfQoQy54:3N15pH8+zGpCQYi5XXeuBGIepm3nbFRj |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 16.53 KB |
MD5:
556698f13933f1fc9dff28725042a20b
SHA1: c4b3a04290d54f0aa1c41701b175d7e77e651e3d SHA256: 0e0e27b6ebffaa5d88e52174a14e2d74823acb676fd881cb8c1f2136406a3209 SSDeep: 384:8sLtLDB7Xuj//fQs6iFWEaRvsymO7s09LRw177GLqEi3zDfj2:r9DB7+j//jiEapsyBjpGJREiD32 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.42 KB |
MD5:
9b0c3077b5e8a66ee133c848d8497fca
SHA1: 4b86fb59b18a34cefe19da406d5b1ee58bba9afe SHA256: 769c4c54a6d306daf2e644152454db1ce31f69d18447f89508b419809401c074 SSDeep: 96:Gz6V+Y+3JOIdYXauigVUv/tROxpCs2UoGhrvQNL/C3ZF9:xV3+3UEodVUv/y/FFQNbC3Zj |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 20.35 KB |
MD5:
6724d4ae64120dd5842db848a3dce085
SHA1: 38710bd0d2c61f800cb0473f30417e3fb881ae9e SHA256: 7fb427e70773f56b2d7be4f849111780b8c8c73777840f94d93d349cfb391d9e SSDeep: 384:9LVMACWG8K1SOT9xeHrZviRSZQDTF8T3RKucCUBMAd2AlTVYoWwk+U7eQ000:9LVMALcTkrZviRSY23RdhZymWtd |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 30.61 KB |
MD5:
715b98e7206640cf1d7f2835c4a22201
SHA1: 255d3ddd5754c8db6bd2d7425558e4eff4eb0088 SHA256: f6f87113ed91cee45e2c9be09b49c6996f9c3f1ef8db1bcd21c996e5dd681441 SSDeep: 768:78EIN1EWIM0ZiCI1hMizUSBO7ymzdv9oSAkxZ10TZSjKI8tCzu:7vI0FxZJI13/OuCiGrjGJtCzu |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute | 14.94 KB |
MD5:
3351981dd86169e373c6ed051c968ada
SHA1: 80cbf90d8deddbeea606318d6c14ca2f5d5b813f SHA256: 52cffce5cddd254489ae7bbf48f3dd6a171917632d5c111c590fce792388f75c SSDeep: 384:MP45JdvYumUfcQ35HinB0A41eWR6XlaHNT:m45J9YRjQ9IC7dcaHNT |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.27 KB |
MD5:
3e38300212d01e6ee522fa4916e5d1b5
SHA1: dff2646e960c0f4c8352650792352c8a09bc865a SHA256: ae52bc3a26094472770c87a82ae740837b61f95ed69dca11315b590c94f2db3a SSDeep: 24:LFoEKg1c86cs+AIS4prkyerc+45zh5p9j21mFIKg9VoQFK4:RoO76sLHrkyerc+Qhj9QmFIKg9vFN |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.27 KB |
MD5:
5bbf3fbe5ea09383c0a62b2d3095619e
SHA1: 04be2335347bc65f13f270883ea0fe56d57899f5 SHA256: b5c4aaa0b088874f03b78cc8486f571d66ee6deae8da9cf8de71bbffddc95eb5 SSDeep: 24:DnVubFCLlOPc1BUGW2Nvvw9inLu8AAbd7mVQcrWz93xr77EVoQFK4:Dn/xkX9iLu8Tbd7mgztxv7EvFN |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.88 KB |
MD5:
5c51d551f069db20988c5774831a9795
SHA1: 1fcdff43cde04b1ea876b82898ef7551b4a72f7a SHA256: 7142c9efdb2546e1a3dcf3657ba3987e449eeadc895247f908cd9d4d567d0ffe SSDeep: 48:qLHBHSbaOMGAy91TajBp/7QcPnpGyzgxei8jSh3vFN:qLHBahMX8WjBB7LpxgpwSh/FN |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 8.77 KB |
MD5:
918106ca8b2307d724e01e00abe8ab3a
SHA1: 8c5523f5069f4ba4a599e22f1a66960ddbde29b8 SHA256: 01b56ad687e5c2e250de15f7ceb0c7074f49124453ae1d2efdd46b03017fdff6 SSDeep: 192:C2kv8QydV7ZFIh8jh3RVjiq0oSeBfUVx5M2phvUQb9YgZBGeCAGwtxj:CH0Bv7HVRv0otgY2phvUUpZBGeEY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 67.85 MB |
MD5:
6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774 SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.15 MB |
MD5:
0d0a57a8df52ee0df091f2ecee7ea9e7
SHA1: 82c49c7476bcf21e1a2451d32b994206c31a436b SHA256: 4e83d4eeea26468e8698f705bb858d0adceb3976499f00ce234fd3b403073264 SSDeep: 24576:zxnP6WBzkm83xgDBo8o93HLJP9VB5bxQrzVDFJdjHs5wuofLfdky20ytJytLm2a2:zDxL8QBonTex4S120ytJyk5iqBfmV2qB |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.35 MB |
MD5:
f65629ea98345bca571642c501cf8d48
SHA1: 4d9b6fa4e5296598dad386be8ab67ec2e7cde7b9 SHA256: b0763c2a0b59056daec7c1cf301220abc30b90d308b493d98d1c7d2340f8f31b SSDeep: 24576:nzyc0opacbhmgk5gHL7a35AyjQgz9vzBA4rdeNTb1rEgLI19/M8nI9Bqjt6o+I/d:R0opH/cgHa3HRxz+4gmRrwGjt6PIg63 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.14 KB |
MD5:
55d77e5246e4bcd7f5bbb1c696bdb0a4
SHA1: 6ebf7c18d24772bb4b7bba2e41616bef51c71285 SHA256: 930a8879b757fbfa079154d140cf299eb9f0610951f91670162b2e805cd8fbfa SSDeep: 48:a2E6gBxjio2cJt+OJo367QDVtCEVIECGDcdCdvF9:a2EJOQn7Qm9ECGAWF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.56 KB |
MD5:
e4547a489a517c0a69a496b2b60d9fac
SHA1: b25757ca1bd675e8663e5d13283fb47199c66154 SHA256: 68014368f4e8f97867cfba2e8e227a0a9afb80e9866f9030f9b970d3d2d56a49 SSDeep: 24:8/tT4kFw39BpsDxMMET57cAwayNkea7WBbJM02Tn15iDJpysiLw+i9aaVoQFKo:8xw39Bpgpu5qa/eaii0MkJpeLTi0avF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.06 KB |
MD5:
3ae163b28aff321513465ed80646b8f5
SHA1: 2969c17447cf579ba897d5203bf24f75b761747d SHA256: 343c8fdf9729fca0628d7ebe87a6a7c2f363cd73b78f0a64c021332231e09cc6 SSDeep: 24:JMwF4iLpFmwkCoF3SiY0BytxY/exdCQsYFRrrVJiAK9Zan3VoQFK/l:fltLkCoFTYJIeFtVQ3Z23vFsl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.81 KB |
MD5:
aa7f09defac8246bcfdd03fd03df1acb
SHA1: de1209ec80121652f190d7c6b213d0a82b48fed9 SHA256: 778a42295542d53de76ca57ca3daf7926bc1c731165395852abbf153f43cb5ff SSDeep: 48:5IP2znyqMkx9nxGiRgLS3iUTYdHiiVc8ivQVvEpMxk2QWv9/hkvzkIljvF9:5IPay4xGMow3yCsZE2xk3AhavDbF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.77 KB |
MD5:
444ec3a3d187d3e6407956c8c26a86e9
SHA1: 4d63c4f2f0a4d72886fdc0f9035e821a924310e4 SHA256: bed1fe9b66c21c5f9ba7de452d85ece52dc264033c52a8b140984b804bc2dbae SSDeep: 48:10txevlSKgt9aVe9KXQuZ0769NWwU20uvF9:10tx8c9tscKXQ0CONWwD3F9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.49 KB |
MD5:
465fd41782f6ae9628b7a6be27674d92
SHA1: cdb1c3e31eada2a3f66ef3497532a9fdefe09ea8 SHA256: cccd9184933c68ad449bc0579d9e37aee7e5e1f66915828928a0d202918471cc SSDeep: 48:tjvfvGt1yd/Dt/CMYw7tENfTsSgIPVZb+xExnz5RKW3IhvgeNdC0vF9:tz4k7/CE6fwn8VZb+xG13I1xPCOF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.14 KB |
MD5:
4245c9187e0c0542283efe4fe90a8fc4
SHA1: 3412c64b912cb4927c05f6e395f1de0fff1fe016 SHA256: 689471c1cbcc63dd1552e4766e307dfd679982f16d3f341131f14a0743cfd2b7 SSDeep: 24:4MCabHA8WOdjLVdhWNv1UxAeVvmQk9pnPT0PNVoQFKo:p1bb7WNv2V5knPuNvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.44 KB |
MD5:
ec01f4037297e4edc88fa38d09483796
SHA1: 3d4160334cf8877b4e60889b701d7c67d03ddb60 SHA256: 4c3626df4f06268bf976cc1b1ce9f56ce1c85518a5284ee0e91dead85e2bbc83 SSDeep: 24:0JA0nnpnGFCsgLss7tEoisIQXECaz0exaQf/Mzsu8Cm5qldHNstjzIny1qk/ULaL:SBnnNIWEJaEH/xLDuU5KtstjzeTWvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.05 KB |
MD5:
1ff9aa8155b6edfb5f1b9632ec28b311
SHA1: 7ebb6055bae36f312eb6d494759bc40bd7787aaf SHA256: 03ebb5d0091661246ecc47a82620e4bbab43d4cba93618a8ecfb50e04d4bc9ca SSDeep: 48:duPqms9u694PSj07PdK1a+a70IW5WVwokUZYo4vF9:EPqms9byaIzU1a+agIWYwtUZYoCF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 582.61 KB |
MD5:
3857a861af0f37909ba9d08ead911740
SHA1: 6c557b22a9eab47988a4a3dec361e3993114e4b0 SHA256: 40147ce88fbcb65683caea1b7215cf58a43f253ddcbcaabdf0bf9cccc157bd7c SSDeep: 12288:06EsvDo91aMuslHT82CbtLZU7KbTdPB0ZCo0MytJXtPMXO63B9X3JzLroh5rdkE:vboraMuOz82CZ9OK0CfMIjPerJ/r6D |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.66 KB |
MD5:
ab5b666af3357cd81420eb9363c5813d
SHA1: c7ea2d091d00c25849495382d57c1c746acdb21b SHA256: 36b116bba7ea5b813ca18baa2748e4b94828760fa915aba3c032ae0bc8549674 SSDeep: 48:JVG1U7etYo0egHKOfZirP7AziL3gXxwM68vC/vF9:JwtPVgHBZYPchwMNvCnF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 10.25 MB |
MD5:
189ba8d1725b3b0b459a1ffec029106e
SHA1: c02a5e070a9eb399eb8ace5ac2ed2eb94da907ea SHA256: 2532c938c2100a044e5af90e360b9705e4f1cf2adc0d5932d96c63a34c3f43f8 SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+B92X8Sy:MUvTiNhU4L7tZiTnprP0txRsSsSy |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 14.88 MB |
MD5:
0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35 SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307 SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 5.67 KB |
MD5:
520e3a8b60858c8182e4e0618e9a7a90
SHA1: 1f026447981536921a579c4b672f765b3d6b9ee8 SHA256: cebc9f578f968994abc410098288378d70930591fa2c7b85c3ab8a6830b01c13 SSDeep: 96:PS7QXmp0MKUj5rJXTcxqgFJHnog8+G6cpw3/yCdo2XTjPBPIF9:PUQXp0jbjCLDHno0G6ikoIf5Ij |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.06 KB |
MD5:
6548bf04c4c9b47bea1ecf17cecf9cfa
SHA1: f5bbe1b0b5545242af0014f002ff4ce61480051d SHA256: bad25e13ec0d8c8266259b8e4438bc82858376ce43f222a1f44982e6b46fd79e SSDeep: 24:lAaLnc2NtQvyLpMomT6PceSzJXfvYlYprKyqM2jBfVmwmJcfwiU0VoQFK/l:l3NtQvyNM3XvzdfgShqLhVmZew0vFsl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 37.05 KB |
MD5:
8a010b64e6dd7fb47fed655e40f2b04a
SHA1: a68db5e180328c563a2e689cc00373493e865e61 SHA256: 13695cd14132993be4fdbd51fea64bf9e4644d59345c5587bef04076bc4c3096 SSDeep: 768:k/r6p/MoDzN3/Jp9HkL89oLiSSQjD8E/EVZ:kD6p/MCZJjEo3S7/KZ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 26.55 KB |
MD5:
340ced1239613cb348500b9942bb68ea
SHA1: b42caed5eabb87466c2b9471b03a1d96e43413d4 SHA256: b2b176f3b95d880683c5c77707c57757a6b6783a13a719f148e6fd5c387ad868 SSDeep: 768:Nq5z+U6luQRpkQ69n666F2sWRrkzVp0gvJng:W6RIq69nBsUAzVp0gvRg |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 26.80 KB |
MD5:
f2d39078777d3af5b3905bb6dca2db3e
SHA1: 5108b8b51cded2bc746094ba38c6a9989f8386b1 SHA256: 15d969988bf0b78778731485df6387fae704b3afb338ad5bea646e12eb58ecc1 SSDeep: 768:WCKyQXO4Q7oXotK08GdVjqTxr2F4zalRUj:WCKyQ+4eoXotKlGDjqTxYP0j |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 69.80 KB |
MD5:
3a93fa4381b93a0d8b0842ebeb110f94
SHA1: 4838446f8ab59b42006abde0f14bf0d7f7da82ea SHA256: bad5044b57ba97353614b3d96a4625746bad16a13cd81ac0432a46a31e47b53e SSDeep: 1536:f/XmpE0+wWDSSZUGV7lpQNFqHHdB1cli8KKKj2Ig/3zb+p9Gy5CZpkG:XWewJqlBXclZKKrFDO9GyYcG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 9.38 KB |
MD5:
1094679a9a469fb2bf2a49d5778fd986
SHA1: 16495a4008e97f23c56fd97b49b7c181b24ea42e SHA256: 1332f0adba3b4e860d65cf215c28a37f726e3c9b02dde0411f0f5eea0f602498 SSDeep: 192:oqmGXW3sP3TNTpetgbj8GN4xUKfjs6NWqA2VYAwTEfoBZj:X4w4tgvzKrA2VLwTEfoH |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.60 KB |
MD5:
f8a131aa93bac514c55d14bb7216e9eb
SHA1: 9049d4b9001d9186ac9e1d3d3f7e71aa238d22fc SHA256: d906ee62e762bad22b87fb94cd05f726266659c7781ada820a94d2343fefd813 SSDeep: 48:uUJXNfJeVTqAIOUpI8UNp3KehKqQD7K5MvvF9:uUJBs5rKkKb24F9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.55 KB |
MD5:
7e51ff8144a92e90d2c25ea47128d2c1
SHA1: e70bbea2ef439943f46b250351c8fd2b4d046c5e SHA256: a720de353da9913aace0678c4a6c8ce4040134587f8296a7fff10dba957f5269 SSDeep: 48:QpeLg3C/73Wci6n/K6/6Nx1vDK/swN0SCxcp1JovxmWTEG/ATywggzvF9:Q6/RiaS33FDKEwPocTG5zYEgrF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.42 KB |
MD5:
6d9490c6904086536df6b148bf2a68a5
SHA1: 55354262e6380596664c8832b0d2db707d66fab1 SHA256: e539634761d51616d992bc9177f3ce01da51d16999fccf378c6c9107f12ea512 SSDeep: 96:/Y4Ct1OM9U/b1I4PKIVGpEAeYlWJt2hkB/bOGncF9:/XC2P19PKLmAjlWJt2hiJncj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.81 KB |
MD5:
efe89f59ee40d7a00fa060995dd3ea5f
SHA1: aae3cd8554c946c8bfb3f8cdf8c1e4cf566b00c9 SHA256: 3ab56bcce9373b0e7bf3fba494617537e3fdf1968f41227d0ba6e03910952de7 SSDeep: 48:QzXTEkqcZygrpEujCON3B0dBqNIySLeQkifKfvF9:uTN0gtjoBqNyLeSoF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | 65.86 KB |
MD5:
7b6bc0e5d8ed358f41549229c7d8ba16
SHA1: ae50f6f049e7c17588cd59c50ab634e04f59ec95 SHA256: 9413714a50c0dbef9763551496cdafc35c323e01f8abd457f3f3ef675e7afb7f SSDeep: 1536:I6jrs9k4c9q5MA5+1TbSxftEAMv9FZUhynMOkph0f8G:PM6c75+1vu6j20ncph0EG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.36 KB |
MD5:
ca18dae98c3ce3865c1b3f0b2fe06dda
SHA1: cb8a233c049b5e17f10f3d020bfa18c15dd77ffc SHA256: b8a93d1cdc4382ebe5b1c953a1bb9b33fef100c6e0063b9065d790866bd824b6 SSDeep: 96:DFNsMBecVxkyQohl73obfsRM+lh+l0+mzUjF9:JCMsxwVM+lh+OdIjj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.35 KB |
MD5:
345166ca57877011a432eea09367cc0f
SHA1: 76d9b86e90a663f604718079dd4e92e2615bc457 SHA256: 55ec3619f8aec558fd15cba2037c5f13120cdc32f2e3456592a77c5a7e57276c SSDeep: 96:waz8p6QKtq80aoMpm4uq3KCkdXLtNfY1pDi3H1rJwVgkZfVMWZfF9:VIsDk808VPky1c3kdVMWZfj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
241907d2607e0e7a93613365591cc7d5
SHA1: 9f5342d3126f8c0fa22044b8ae63e55a9572bddc SHA256: 056b994c9a5a696fb64c8f5e91444cce155fa81fcaa7ff83f5bcf632c202ac00 SSDeep: 48:t2vLUAZtjZiZIM/BtiIp5EKrNRWYamjwbIPvFsl:MvPtjk9/BtiIH9UfmcbaFsl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.08 KB |
MD5:
6add896a5ce9e131e49c97b99fe1ccd1
SHA1: 4c3bd7d3a0eda0829285e35a3d319a61dd0ff0a8 SHA256: da656de37f3d87f3a06a4c9e102edfc5d2d910429ebadfb00a74e7ddc797c993 SSDeep: 48:1U0N85vasXDvbGaBRcyBupk3Jnfz9ji8q/METQgY2Nbac/YwvF9:1dN8BG+RHT5zOMmJY2NbZ/Y6F9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 6.52 KB |
MD5:
fe3e388b41a6618d3859cbfd4d09bfbe
SHA1: e75629f997419f45772c25239367a23f3f49d22f SHA256: 0c0b49a763ffad55924909e7bbe38b891913b737d0ec3ec797dacad28969d94c SSDeep: 192:edDkNgQurAYQ12EI+Cx5lO/oNswyr3eIHj:eBi4UVJwjlO/oNjsee |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 16.53 KB |
MD5:
1127ee8ab8e2f6e95c929850e59adf18
SHA1: 314c1fcef6e182cf01ee9d0ceebf3ebd8bc3347e SHA256: c5aaccc23895dd2014ae6207a4276b33a6807fde2e3c5cc5eee633656b8055a7 SSDeep: 384:lBAXGkszjjuNQqZmcgQE+ipDWx5mmPFJev6Bgn2mN60C8n:bAfs9OeDG0mNJeSg2mNnn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.08 KB |
MD5:
86f8fb203907d0ad63f3274a57992fa1
SHA1: 78d9ecbfbeb6e96fa5a9251cb06bb6c18f6dcb44 SHA256: 64fd31907b2c8743ac63ec8ccfc711e33de010fcd85db258a8442d307ee3be15 SSDeep: 48:8E791i79xWZ9NHPSis4MsUuBXXJzRB2FV0oc55l1b9obYBE7BwKvF9:8Ex1i79xWZ9NKisBsUu5XJzRB2FV0ocQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.56 KB |
MD5:
036233dad6de6ee49ff1303bb4f7357b
SHA1: d9de7f8ce4958b9a18e03681101557638b40f359 SHA256: ad7901017dcaeb407d037c1f7f43f02d5a69f03115c084f83297417160f861d4 SSDeep: 24:0bJv/88zsrws7lq/RG50xoex20yMaaGdxwxOY/2iIPaveH2HNUVoQFKo:0N/Zs0pG+xn5yMauxGSveWHKvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
04033515c9d63f798c3aa7c3e087f4d1
SHA1: 52a3723d8facdfbf58fb3fb0b4edd37dd9c8fd47 SHA256: 8033a2bf4e864f8c9184a15ba85d17f6db10a2e5b89382041eaa5ca449813d8f SSDeep: 48:yBOUv1K86CfBORChOXkPpRWksxRfbYyOvF9:+OUvY86CfUABpsf8y8F9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
0d2fef04f674278a344941ce3f257683
SHA1: 2a83eb15217b5dfccd97ff5575c12dbae9d4a93d SHA256: 596ff03470d315efd83e77859c1b179080a4d0e874a347c835150d292682c09a SSDeep: 24:3L747QyaOjCiQuSh7nHa6ppBJzG3aK/gNwCaS2LpRUiekh0Uc+1vhHdRvP0VoQF9:3L7MQyzWnxzBJzG3aK/gbaVtQFhwkvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.03 KB |
MD5:
dff33c0884a8dec50c0bd29f77a39390
SHA1: cfa816789e0257e45a6716ec9421744a93b10e6a SHA256: 53fb671cb911cd76d6cb1e427581c9caa4b59e933b16534e3ec506306fc82495 SSDeep: 24:x29JIsOPE/YcM53flGyUI3qs2XIPc5JdhZaWTQVoQFKo:AGrP8qNGZPwkVaeQvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 16.71 KB |
MD5:
48f6d466b9176da31f094d7c430707c1
SHA1: 66d6fea0ba8132382468453ea81e3dd79030de31 SHA256: 8e1b9828b88edddfbf61781cada8e800a5b92b8188551a0194babf876d3135dc SSDeep: 384:7Ppgc744iVsSTry88isN4sFvoRJfUjkAFWiRn7onEFcUzaS:7e/VJVs9F2cgAF7ekh |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 5.99 KB |
MD5:
afebe6487c4509e7c6572d1f68e2d867
SHA1: 1cc8f4c097efc06c57b3771bb47a14984cdaa57b SHA256: 649a7a4156337cfe29bf4c31cc7615c5c2c2cdfe351f4fad07c50417da977106 SSDeep: 96:eldQ0LVgyejRXTT8/XGisObk17wcEIEqdGW2LJJ6Y8ddjuGmnpqSOZbaF9:e7Q0xBejRX8uiHmENJJV8CdnYNbaj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 30.61 KB |
MD5:
bee5a4514cd770ff045dae65e81db12b
SHA1: 54f3eaaa60da54f95b17fdfcf9e3f29f5ba1e70d SHA256: f4ed9eb9dfb5730c2bf32cab3e99c11ab6f1b1de57814a5e68c1e0dd53916b77 SSDeep: 768:pymIvzSZRhLcqozTxYyPXbpdKjs9ZKUJhCW/99:pymIvQcqozf/bpvaAlF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.67 KB |
MD5:
73f07686ce2c3ecb31a09a063d63c549
SHA1: 5222246ad7ee23e0c5a4c44b8c2ee20e225a0997 SHA256: 431372265aaafefd414a6d01c37844d17ed856a5dbff85b4b424e953edf3f6f4 SSDeep: 48:lYxyEnXoy1wJ4socZWDCSrq57H6CDHvFsl:lUyIXoySZWD1q53DFsl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 6.35 KB |
MD5:
1d823d1d9492b31e4c46a4671ffb115a
SHA1: d62d69c4f4bb5f5ea879b3c1a4518fcc01d7e810 SHA256: 6161cd81dacebb26cd83369d9a37f141c1fd0bf206780a8a00ccbe575d5c88c7 SSDeep: 192:ip7hRwmvP1Iuypk7DxpBTG0nYlyhmNajVcNXoUmj:owiNeKDfBHNVEW |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 9.52 KB |
MD5:
eb1bea118d75b4258f8afe20c77e92c9
SHA1: b87e99ae0223ae88c2b67aaf3c79f308bf027caa SHA256: fb06e52e78c22c7b38720d4dd12fa4d8015936643270ea6d941c79b3f3f5f769 SSDeep: 192:RLMKAuEfNYH0s/JUaAMGvYgN8pZzv8SQHUS4oS4f0gqbGRv+YJSfqwvYibOj:RLhAuUYH0s/JUaAgTjJaUrD4fMYIvYP |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 20.35 KB |
MD5:
8494745e3d43ffc5ec55a77136c346cc
SHA1: 0ff72546d3bf341f363e57875c98fbcb45763607 SHA256: 31bf90c847e78bebe40553eade79999d15afac61b0e0782ca672fb22f004b56d SSDeep: 384:81eEfa19rlY69weuMj8Tq0EcmRQPvTv9BxcqvnXmOoUcMBhbPB2Rh89Y:weEfavrlQeuI8TX/hB5ToUcS52nb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 8.77 KB |
MD5:
79c34ae3124a4d5f4f35d9e8e8faaae6
SHA1: 2aed2e0ea09b554cd585fbc7c6f3a64f93b7a02e SHA256: 1de99132702fabb56c3c7a2e23e37e4e52cdad649f211bf5f69aca78f510105e SSDeep: 192:9NZWHb4zx19FFSEqfv7jVRDpeFUDdCpGIzgkrmnDY40Cfhj:I4z8ZjjVdoexCEIzg7nLXl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.81 KB |
MD5:
e56a724210e86406ed26d93400595441
SHA1: 428834162d10394dea03153b62039fd66409f9ad SHA256: b5955a22610f9421fc2930ae7d31817e167972723da3f71828e0808a099f4495 SSDeep: 48:BE1/rWIGf+S+9Rz4OGodtHiiXbSINY2ticT6gts+9LBEAWFlLlk+OvF9:szvGfv+994RoPiMSkFtHxs+xBEAWFlLO |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.00 KB |
MD5:
3b602c487efed8d6d0008d370e6b86d2
SHA1: b3b304c878684c4109173154c1dd13c246a99988 SHA256: 9b25c819ad09476017c19ba41856d77782d2e965316da6f23204d739b4e56e63 SSDeep: 48:URKlM0vMdKUGOtNbWVlXJfwRGZ2n0oeBvF9:EaMnQaOTJfwRo2n0vtF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.61 KB |
MD5:
ba0b661f1870305f4d2a3ce29818c401
SHA1: bf7b7e463ad36be15363c63383d3dc5320c79102 SHA256: 8993b5a1194f22ad926e84b97307a61ad17c93505976b8eea2f411e428935deb SSDeep: 48:KZnAebU6E8013J0NoCfHJ9iBJnd6aw9L8LsPJveKvxyjlwpvF9:KaebUb8013UoEHJmndI9L8wBv1vxypkj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | 11.44 KB |
MD5:
453a94c0f4aa2192af02a34f4ba8cbc0
SHA1: d0d416339ce248ec02918df9e609eb6eab4faffa SHA256: e128bc332e47e80625e5a9e068b271ee37a9d2052d48c5d249eb0b5e7a848059 SSDeep: 192:68NDb0U+FHP3i1fbopg75co5QcjENmwD4bh/qMB5cjMFwh2YW6dw/Gt5alxHG7qQ:66/0ZHP3kfcs75Xe4t/qucgFPYWkMGCK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 8.96 KB |
MD5:
eb6ebe8aa039ec0c2b83147aa860500c
SHA1: b224005282e9e74cde8db536d80f6da6f58cb197 SHA256: 44c3980910bf5c580b71b9ddc45b1406b13ca1dd4d8aa269b91e54fe8fcbfc28 SSDeep: 192:JWrO+g44+1PfGNXBMXajMt2A7yQGZdDxMyTOj:gr73p1P+PikInuDCyTi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.05 KB |
MD5:
3248b650149a795021a137887840d0be
SHA1: 5f6576f95a1370673ce8ef3015a6d4f27e3df1ef SHA256: ac1d3ce95ea7c296a327a9a1cc2741b70881ca6e2bd0c16148cb1d9506e1f43c SSDeep: 48:o67c7F1Lw6zzAmObkXqzsS+TzgMC+dZuGo//ZZRC8lrvF9:DQR1Lw6zfOYX5KGZQ/BZ0IF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.86 KB |
MD5:
1c01f031c8c5efead789f859009fb806
SHA1: 75854fc9df7aee34a41acb4b521e14c47e4885fd SHA256: 6c5bd1b6b9b7ddc71c3bc65cf1e61f61097d0e5d1c7a0a613ac65c8b4272b0b8 SSDeep: 48:GKh3JllT96CmTy5SSlX0PzvqtSs1PEzWmbLLyeeESPB/GMQWfoBSSvF9:GeQaOKSwMzjb9HNDaPwF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 8.61 KB |
MD5:
650e1d69c90c9d261eac4a901f27e1f5
SHA1: d1dc526f2a2280104b39411a84b8425dabdb277e SHA256: fc78aabd6c134d2473413581575184d208875ffcee72ac6da1e8bcc5a00a1eea SSDeep: 192:sy4/REPPQ9tqy+mNxkYoAvGifPQyh6Lbe9kqsF+VCPsWj:sTqPI9tL+uvvnPph6Lbe9kqsIVC0q |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute | 222.22 KB |
MD5:
2a5b2d328f0d4d9fef6582df504e2cb9
SHA1: 79a88f27979089dae773da8701168353063b5f2f SHA256: 4edfab399d30255076c77e0b67a9c88375e19def82dc74f8f80851c512e81eae SSDeep: 6144:fqeKABOS9Oac5OKZ3T3GwGkJyKxkXFSfarw631:mAEOOZT3R4KxkV6arwG1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | 38.35 KB |
MD5:
bec47ce07cac1a6f74d6c893e70bdcdd
SHA1: d32480cd12591edd06f169018005429091f6c6d9 SHA256: 2d67e99316867ca726c8cd8b011e9787093023b77529d7aef7f7fe16d9d7e442 SSDeep: 768:Mcdg/nLOsn6XE89N3p0QEUg/HghQgFohwUgyZfW7um/otIz4E0TdP7W:/dgPLrUN1A/AfuOkZ3tFEmdjW |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.48 MB |
MD5:
f80560a439c0f558dc93db0f2376cd0f
SHA1: 8a9165df34b90b67dc215bec9411a14e57d28964 SHA256: ceab5ae1376c82b7baba052595e62c0a83e1201027eadd5a73da17152946a2c4 SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6dHaoAXF+lk1RPOdXi2el:fqLVW6vUiu1gyLl |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.13 MB |
MD5:
f42ca83d3116cb11ed279e9daedabc3e
SHA1: 04dc824dcd66b506cef7e7791445a54cbb3dc10f SHA256: 602bbcd7dadc594d570ba1967a2cd08b42445ded825befdc1c4e437f5c0ec987 SSDeep: 24576:i4igqcYvr4eBgTj59SAP21cHmxMMSnK1weCJGWyAnE1:cnvr4MQ5IAP6cGZSnK1wxxyoE1 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 42.53 MB |
MD5:
4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63 SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.78 KB |
MD5:
de702a313c807440416c542c8ede15ad
SHA1: 77cd8121712d3f6a6a17c03b073d9db923ea7259 SHA256: 536a71d38f5cd608c4ffd4a711afcd5f20c9edf297fe11e4f9e25249e0ba8aa0 SSDeep: 48:nZPe1fRkib2umAP6dut0FOzVySZwxLCB76vF9:01gyGF6GxLCVYF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.16 MB |
MD5:
d6b52b760650ef76259b56307e90ce8e
SHA1: 993ec64334c9e944956d9befef87a9f7a66e5850 SHA256: 60047f37851aacaab0afa691268c008b782183628ed317089bd1f1da93b0671d SSDeep: 49152:zDxL8QBoSTex4S120ytJy7gG/WxNo0q3k8a8WRR2:zR89r1zg82NGIR2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 24.89 KB |
MD5:
4ddb118fba38f9804630947e11f89107
SHA1: f25d79e2d62c7e69100334d3f59c167578da5cce SHA256: 7124c80bfd81a53521eccf0d56dc84f2bddc75558aa55fa803c72cff3cce69c7 SSDeep: 768:INAoc1VYvOUC/HyCSOX8O5EiUN5EouGlrUJXWnJmEG:vnFzPyCnd55eFeWnFG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 19.56 KB |
MD5:
487931a592215f79b2c90577e35385a2
SHA1: 32d3627b24c9a31af995bb06b89fd8f11d845908 SHA256: bfa61bba401aaab68531f88266721320250e3686c7add5a37f59ce3f2358acdf SSDeep: 384:ouOd0vkMq9XVyRQ8pBiuE+u/4l9M8FhuNuKkEdAcoUTbo0ngZ:oddYkZBVyOg5BFl9BhjKkPf6k0gZ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.03 KB |
MD5:
5852d9bdb492514f9376063fe44706cb
SHA1: 8003a3f4a30a0953ccfe659e884c167809621b07 SHA256: 149e6323edd002b85b8922477f38e3a859d063e5c1a0e2963e614460becc0d9c SSDeep: 48:uHD7g4150Ik/WYuJkCSgmmNGCDEuHDO0V/IXmY1Fi4Ae7KvF9:u4E50IWpsVJb0mY1FUF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 34.35 KB |
MD5:
ce4697bd89ba008d626c485703d6492c
SHA1: 4c0c49e6422ae6443364f4207adf06fa8df5ac1a SHA256: b1465bb0c7f3964d6f34414af7399f8faf866ebf110f015d15b11ebf0d7bd831 SSDeep: 768:lcSveNbsvHw37rgWecLzr5SrMPrAAHeHdvXjuDYVEO/5HytqCykVoNq:lpySQLkWdI4TADvnVEs5cdVoNq |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.38 KB |
MD5:
9a54fb3eec9277ff391f72e1827e335b
SHA1: 2e5b75dacb6c007876db6d95edd7d3c2111fcd4c SHA256: ac3c053e5f15fe4efddbdfaf239f721ebe129f151fe8073d7249db7073c3e94e SSDeep: 48:gD/tLoRgrCWYuQ0WRVHwYlsUIVU7nSbTQFLa7mDXIeVivF9:gzp0gr20e/lsIS/aaiDXIhF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.16 KB |
MD5:
693dac062502ef03b016aa5bc021a927
SHA1: a5bf010a56d9a1f58cdad7d2ae6758afad6e2d57 SHA256: 57f5bce5177780fa4246dab603efb34e4e4e1f3d2318aa4f4ca521387e1d7b5c SSDeep: 96:FFwN+Un7VvSh5TKOgxE2yhIR9WWRR96bXBr95F9:FFwN+2pSL+3yhIrWWB6FR5j |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 20.39 KB |
MD5:
4e06f3805df9714a680f9241a67456c4
SHA1: 9b7b26f42856ea6821e9be5847497dc84d6bbddf SHA256: d708553c6922c7da14163df8b0a081615bc052da566c9c4360764e5925c71a66 SSDeep: 384:fg/3hxx41sQY+rxksAxo8wG4Pun6nN4xKJhdxCpomQzJLL6irfZBDsRQ0qQvpOyo:fgvx41sQEsGihiKS2bzl+cfZdQv7gb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.77 KB |
MD5:
dbccae8cd8762aecdf6e25fdcb93344d
SHA1: 4ad636e4779d474c54e93cc79926e11e78526ca6 SHA256: 391233ccca44041364a38a67eb86a9e497cb6bd8b34ea889fa926a6e774a55bc SSDeep: 48:U6uh1QWI7HYTWTiUEF8I1m8V4UJfXMvF9:U6ubQXDiCidFV1m8VFf2F9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.13 KB |
MD5:
b657d893898e7eaf0b2ca27e46d75580
SHA1: ac7689630eca0456deae389aaaa55acd4c854380 SHA256: 377659de7ca90825efa6c3474cd80d804b0633d68cfe1e6789d15cb40ff6fa41 SSDeep: 48:oU8w/NdN2mTBc24SeXhthQtx1RcLayvLjkAZSX1Ah96q5YOBhcw/AS4vF9:oUldNTS24d8+pvLjkC9LhcqAF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 27.00 KB |
MD5:
54ca72b9457d4df9bc720e5febe09868
SHA1: 7c6ff6d5d6143634cf67e9c9d6b94193fe805921 SHA256: f2b7362548b02a8b337ef0e49e38e93533b1c2b4ffa1cd7750e439dc7ca41274 SSDeep: 384:BSNuStT3/ntOJBCrjEw0T1mTaKqS8z0v8lisMTPkzUmj/UrDtdipOUZqXxlFyQ1w:ByuStTvnmAeTlSlCisZKrsqBnyQ1NLy |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 3.64 KB |
MD5:
4a9d610f8ea9ed9e1f4b8a288ce868ed
SHA1: 2a2c027bd9b22fc9e1a1eda3f5e366ac0ebe0bd0 SHA256: 0e84899b300eae37ce35bde89bc8edf07ee5c86ccfde6e386bd4ee2284a6a553 SSDeep: 96:FebSEssU+nTMfpyKX+y0LbNkSWy9jjFnreq4mTSrF9:LyYkKuy0LZkSBjemTSj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 32.49 KB |
MD5:
93ad27fb76046134cdf86d9e105c7774
SHA1: a3229a52ac2bf678fe3c6c49e2bcd9269d9a7c5b SHA256: b28829d7a55bc30aee988a3b351d88f3eee648feeb49627ff7bcb7c12c3f338b SSDeep: 768:m0LrrfL4IMy7ER+D0hSgBH0Ez6JR8/Z1x01TDvZZPCO:Lbfiy7ERAqH16Jwx0lLX |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.91 KB |
MD5:
2ef86209f9b38b80af3f66d75228a183
SHA1: a76aa26730cd6b877895cda0fd4a136ef2fd9b55 SHA256: 013261c44db5a0b568d8aae3a887946b39bb3087af7a0cb657c267bf3407a183 SSDeep: 48:a/w3opZJKo7IUR3+lvQ1OUSJcokcKycEnkZR5b9jauuUKcPenK/OXchgG7OgJjZY:f2ZYnUR32vQpSWv75cuFKlK/OXch/rUj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 42.50 KB |
MD5:
f910549ab4572ebed4cc729c9d3e310c
SHA1: 914d3d252c29bbc19402d5a5a7e3e1a571437067 SHA256: 1e6e3890700caab537f77f55baef149f2d412732d4bb56147ce7f0fce66ee8e7 SSDeep: 768:wqGnguMVzGtHlzOJfAus5U7lDRnw/VZxFSZWy/chBNkHu1uDGYVA1:JsnaCtBOa2pwdZxFSsPn1uDdVA1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.17 KB |
MD5:
9e8d326a60b82f11eb0a5d8bc0d88298
SHA1: 417ea71ef770d1351d86af417623523a10e92578 SHA256: 7bd9f8b7cd81ae227fdacb438cd1a5f3f3852dd861d1afb5799685633d14fa39 SSDeep: 24:8ktnv1hhJvUbSrk+kvM3fEu77UpMu1nOU0u75NlGy16rRJKAVoQFKo:8gJUbSrkjekS3U0u75NlGHvTvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 31.33 KB |
MD5:
3d051f55b37474977b812c284dc96294
SHA1: 4a4c39e48a370d329a82daff6cce19c82907ac18 SHA256: c99ad87347881553f7b1f71bd6f08f7d81f445e8cdeae8b7e3c5237eac00d943 SSDeep: 768:kM9FIJySXAEFXC1ncZSD89PvjWL9cKV2AIladmz4Gj+T:v9FIASREco8PvA95VgladTT |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 32.08 KB |
MD5:
a1587333d5dedd1be02f85aafc8f6105
SHA1: 3b45ceec51d668564ff43fad9dda8e2c547c38d8 SHA256: e4a9deb0fe6c1703d9e4e128c3944f71c99c2f67763781cb1cfcafaab5374362 SSDeep: 768:fp5hDbeLhihG5BHVBtLo71KODlSxgDI0G2vVlR7/XRPD:fkUhGXHVLy4ODlNX7p/XVD |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 11.70 MB |
MD5:
052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021 SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | 855.25 KB |
MD5:
e6d3fba479cf805ff4e2e0b4b0eba97c
SHA1: b3f2a46ebfbda1f4dcb91d26f7ef8ccc2ab67e9b SHA256: 940de93875dda2fd3dd5b87392cc849457bfeeba59b763c5d3ee7ddd932b0481 SSDeep: 24576:JkQJ4IEM6f1iyjeuWBGa2cUZquG/WGc6WIrhfRqvFV2:JkQe1fje0caq//Jcx04a |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 29.47 KB |
MD5:
4e5fdbacb1b6e278b75721d453be9991
SHA1: 9b9175f06efeb761f6d4ba2949317908949773a4 SHA256: b2222a0ad8c82dcc1e48b7e47f7bb70a41b73594de59cdb415a944d9b557785c SSDeep: 768:pRt/WJxs0+7+9m19SkSRLsqT8aosKeXT/BB:pYxs0X94S1sqQaopeXT/v |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.58 KB |
MD5:
7a2cf692812b7621bd0e255165547d0c
SHA1: dd2af000ba2aa5b2b3e684d597f7cacad09ec001 SHA256: 04832a517cdc0803737395791224d8fe2704f60e27692b66b2c4c2a7d51def2e SSDeep: 48:S3W7j+JUBEHYjZ44rLR2jcG4tvLfHD10xvF9:qWSUBE4jZxYcG4tvTHDQF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 20.14 KB |
MD5:
fe3d0bfdb0ee977d5c54bc147c7f36b4
SHA1: fe0fa780a1b13ef762093c5713618cac086992f7 SHA256: f8c72140bc6ea689825b5f737138990ad3f150665f6b8e0d21570720a97b86b7 SSDeep: 384:y+sX247Ey77Q7F4kQDUtnL+F8x6BnYsy207cJsLetxDF3YjgC6W6Wk:yBG47EyQp4kQumes+jcJEetbYVb6P |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.50 KB |
MD5:
0cbf14af88f2e4189c40534933973b64
SHA1: 6f2a1438ab11e404f7ebfcc44b3b397f9b4caf3c SHA256: 36b80763e350396b9c31de024e08f24fa557c29d4090d2114deecd738bcf8bc5 SSDeep: 24:/8lpod6y0rqGSsIIMssmZ3w6hdgV87hljakYRnZPYj31ah8tDmTLrVoQFKo:/wpc63CxssHwdg27fjDYR1YpTkfvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 20.33 KB |
MD5:
d6ba68fe65ad1b1070ea0a8e72900066
SHA1: 2bd6b7cb734ab166599c48b8b97615462a8f281a SHA256: b6e4b41ea51fa1b10a786643b30cef9526a9f658a96949b1d37c1f3319678cd1 SSDeep: 384:9wrTgrJ5NMsMIfaWSa9JhMY3R4O+whn+k9a4RH7uXqz0CLXSlFe:OrkN5RZSahMY6Sx1/RH6X4Lk4 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.24 KB |
MD5:
05d879de008a92f2380737c3e142fdcc
SHA1: e6103506a074dc67ee9711aa5c6a97a979be9c1b SHA256: fe20bd50ce241aed04fff97d280db61b0ac4814b6a2bd214916bd2e42e3759e0 SSDeep: 48:telFHzWthnrrXNvqD3kpKcAEcb12VRmE+ks6OB0SvF9:tSFT+hVvYCEYmE+DrF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 28.17 KB |
MD5:
c014a588f02bd7e4fd5985a759a02d46
SHA1: caea6c02a2a6ef8cd16823addb4b5919ae1ff6e1 SHA256: 92c3337168fea72f5a496c69068aaadfeb24a26c457e20091d4e39460b9f6cd0 SSDeep: 768:EXbh0l+ydjkt4dBpiVQ3Gyy6BXOKTI8mNNdSzUP3sKxywz3Dx7:EG0ydAt4XAQ3G1a9Tj6dSzDmye3DJ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.50 KB |
MD5:
b1c8d3b93cf7c556d1e8842d9d9c0b21
SHA1: 8c991e954d531ef59e5014a915fe65550a031326 SHA256: afdce84c909bf4171f4db18e845b83f02c1beef14b5616db5768fb24ae6e3498 SSDeep: 48:vosxgOlMhYpr05GbEXkNXMCY5Y1zYmTkKvF9:QsuyMtMg0NcRSdYmHF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | 13.76 MB |
MD5:
42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163 SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455 SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 4.11 KB |
MD5:
1c10387b8db15534f7230d1e0e4070d2
SHA1: bf093f4219991746eee386d047111e556697e6ea SHA256: 4351648d95a3be78cc63d95cae4ad25a14daa298255ac0b25241e93786bb3c58 SSDeep: 96:i/Wg9vQXNpbN2rYG3vBXAOlIcH9yHqdMjgkvMwuZPf85v+eTAxF9:CB9viNhN2VZHmPZvQZPSGeTSj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.66 KB |
MD5:
85dbded6ce484b841335897d6cb90356
SHA1: 9d1bb58963df1d3e82e0aeb3a8d92c354e46d37f SHA256: f36731e56482217f4615e5b0a47dab35c8f2904d4befa04c18538e7ca7ec73ee SSDeep: 48:gToPHydpLoKYUCy5wWeYf8DgYIRnA8PM6xkivF9:6ovSpP35wW/80RAEM6xvF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 24.77 KB |
MD5:
7e63a4315650f0b2e286786c7b0f0344
SHA1: cc2bd715e8dfc03323597fd34a45757456cff077 SHA256: d76023d22715a1dc7d74c2dd36e4a9a64c44a8a241c09cb782c89e0dc59032a9 SSDeep: 384:bDbiv2zdGPQHVd3Gj9AlgtjpbceqvGdb2Rv7d34AS/xF5usqFQ2D:bDbaOdEQHVd2uebFdbI8/H6C2D |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.56 KB |
MD5:
8163e7bbcf2f261d69bcaa98ea6fec7b
SHA1: 05de27dcc9ff61ed3bf8d3b83916ad13471cd4fc SHA256: cfeea6fc907640616ac91afc13869f188a56478cd534d7546463caf15c0c27e4 SSDeep: 48:rDFFZ65/yeDOu8D5wItuJkSTp2dPyGhg4Y0svF9:rhFZK/k/VwQu6S1jG3PmF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 31.89 KB |
MD5:
0452191dfa3bc62a27b96d1465b2c18a
SHA1: 56267d857718ae24c12fa06b739b6644743ce271 SHA256: 42038f4acd4bfa02c5366cdaf904b1f7097907ca891d2f56a6455e380e049c62 SSDeep: 768:iLKMvgsLOpIbwUVSSWbh/GV6FlXOWCHhH8YEMyg:iLKMvdLFsUYSWb0VolXOWCH+lg |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | 32.74 KB |
MD5:
05fdea069a5b87f66a18221b10711d1b
SHA1: 3e125dc3648b0d77e39937523876c8a2bef97ad8 SHA256: b392c1c58844e23c7921dc23bc3c441d11c9666369c3ffa15d2d9b41f3010c7d SSDeep: 768:GHy3vCzzNz4h6ivZYvSwwDp8Xgr0bFSsx1qYXn/PR0czwrpH6+4FoGpZupUu6/R:cy3vUzF4h6oS2l8XGawsDjX/QrpHpes8 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.81 KB |
MD5:
22541bca09067a8f483f72d66f759e71
SHA1: 3fe02b71736a0b32a9d4db9dc1a97edcdd4b2c7e SHA256: ad7421cc80494d97f7a329ef8e26ae9b58a45c91540240c176b27aeb0375e0cc SSDeep: 48:2PMHNncNij9TrX04Kejppm+S7PEQlL9WftXvF9:6MltT57pml7PEkWftfF9 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 6.35 KB |
MD5:
6b1834a916437bddf5cecceac2c576ba
SHA1: cffaf48e05033511433fca424a3c6064aef24e7a SHA256: 65d507559c5f2e70746b5711e13a8207e4232abc40f8bcb8447d87e4e3d5bec3 SSDeep: 96:wYUplmyub6NIPcfzNr7Gtwcz/fP3eUZRP296/T16ZnplgBaTaOqxzOvfQkhkkNF9:wXlWPyN4/fPuUocT16ZpwaTkzOvYklNj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.56 KB |
MD5:
9b2c883e4464dfd81eb3663c2cb7bb52
SHA1: 47e6a9f2a9f32fef574555e93786d89c4ede6bf7 SHA256: 323c016e260302f2164b07d40003be803d2751dcb9db02c31ebeeae8814a441c SSDeep: 48:389yodTwZsqOVZynIvGMDeKZy/73XjqEWTjvFRZzM+E0vF9:gLdTwVOVZynIvNDS3zMnFvz/XF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 2.19 KB |
MD5:
7084e522d0cee15965a33d770595ca8b
SHA1: 2a0c37da0eae7de3e53d3bb07d3ab733322d99cf SHA256: 9d940165aa239437f51d02b2099ea3029bdb3a6ad3747642061a762473bafd6a SSDeep: 48:rr8pJOwNFgSNjIyT/XF2wNgTip6034JQWw8Zy/R+dFvF9:P8pxjIyT/V/NAip6gI8obF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | 1.66 KB |
MD5:
37c38fb158a4eae9d8d1c4233359b530
SHA1: 4d99a5321746b626a9b1ac72b4c65be5b9634f9a SHA256: 02fbc0a7db13ea06547941b274f6475c1d1f7c221b5560981ae8e65e92b49c62 SSDeep: 48:SOrWWElL20y8NoAaWUDa2EtI39lq/N17jqZvF9:SOrWm8N6N9Ve/N17WFF9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | 898 bytes |
MD5:
34f2917625aaac3c55f71c5e72cca6ea
SHA1: 4854385ebcdb08e4404f9c5e11ee08af55ed2178 SHA256: c1380a2cbf2289d1bab2c18f577b0b7c4dfbdc8744776de3820bf34b5d6da1cf SSDeep: 12:V2EvQ8w3e1lT/vz3xOxx7U7Pct7pUIQdxghb9CiAE7K/r0cITFX+CpFS5hcnAYSp:V+vUGJa0t1bbOE7KXIT8YFSfJVoQFKo |
|
|
Host Behavior
File (2379)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Get Info | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | type = size, size_out = 129 |
|
1 | |
| Get Info | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\BOOTSTAT.DAT | type = size, size_out = 0 |
|
1 | |
| Get Info | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | type = size, size_out = 89168 |
|
1 | |
| Get Info | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\da-DK\bootmgr.exe.mui | type = size, size_out = 87616 |
|
1 | |
| Get Info | \\?\C:\Boot\da-DK\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\da-DK\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\de-DE\bootmgr.exe.mui | type = size, size_out = 91712 |
|
1 | |
| Get Info | \\?\C:\Boot\de-DE\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\de-DE\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\el-GR\bootmgr.exe.mui | type = size, size_out = 94800 |
|
1 | |
| Get Info | \\?\C:\Boot\el-GR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\el-GR\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\bootmgr.exe.mui | type = size, size_out = 85056 |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\memtest.exe.mui | type = size, size_out = 43600 |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\memtest.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\memtest.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\en-US\memtest.exe.mui | type = size, size_out = 65536 |
|
1 | |
| Get Info | \\?\C:\Boot\BOOTSTAT.DAT | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\BOOTSECT.BAK | type = size, size_out = 8192 |
|
1 | |
| Get Info | \\?\C:\BOOTSECT.BAK | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | type = size, size_out = 1565 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = size, size_out = 2296 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | type = size, size_out = 1450 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1886 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | type = size, size_out = 1450 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1608 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | type = size, size_out = 3186 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 4207 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\es-ES\bootmgr.exe.mui | type = size, size_out = 90192 |
|
1 | |
| Get Info | \\?\C:\Boot\es-ES\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\es-ES\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | type = size, size_out = 89152 |
|
1 | |
| Get Info | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\fi-FI\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\chs_boot.ttf | type = size, size_out = 3694080 |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\chs_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\cht_boot.ttf | type = size, size_out = 3876772 |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\cht_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\jpn_boot.ttf | type = size, size_out = 1984228 |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\jpn_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\kor_boot.ttf | type = size, size_out = 2371360 |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\kor_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\wgl4_boot.ttf | type = size, size_out = 47452 |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\wgl4_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\Fonts\wgl4_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | type = size, size_out = 93248 |
|
1 | |
| Get Info | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\fr-FR\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | type = size, size_out = 90688 |
|
1 | |
| Get Info | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\hu-HU\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\it-IT\bootmgr.exe.mui | type = size, size_out = 90704 |
|
1 | |
| Get Info | \\?\C:\Boot\it-IT\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\it-IT\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | type = size, size_out = 76352 |
|
1 | |
| Get Info | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ja-JP\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | type = size, size_out = 75344 |
|
1 | |
| Get Info | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ko-KR\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\memtest.exe | type = size, size_out = 485760 |
|
1 | |
| Get Info | \\?\C:\Boot\memtest.exe | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\memtest.exe.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | type = size, size_out = 88144 |
|
1 | |
| Get Info | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\nb-NO\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | type = size, size_out = 90704 |
|
1 | |
| Get Info | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\nl-NL\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | type = size, size_out = 90704 |
|
1 | |
| Get Info | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pl-PL\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | type = size, size_out = 90176 |
|
1 | |
| Get Info | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pt-BR\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | type = size, size_out = 89664 |
|
1 | |
| Get Info | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\pt-PT\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | type = size, size_out = 90192 |
|
1 | |
| Get Info | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\ru-RU\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | type = size, size_out = 87616 |
|
1 | |
| Get Info | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\sv-SE\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | type = size, size_out = 87104 |
|
1 | |
| Get Info | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\tr-TR\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | type = size, size_out = 70720 |
|
1 | |
| Get Info | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-CN\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | type = size, size_out = 70224 |
|
1 | |
| Get Info | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-HK\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | type = size, size_out = 70208 |
|
1 | |
| Get Info | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\zh-TW\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\bootmgr | type = size, size_out = 383786 |
|
1 | |
| Get Info | \\?\C:\bootmgr | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\bootmgr.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | type = size, size_out = 16972987 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\Boot\BCD.LOG2 | type = size, size_out = 0 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | type = size, size_out = 2506240 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 2424 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | type = size, size_out = 1800 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | type = size, size_out = 1347 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | type = size, size_out = 1457 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | type = size, size_out = 1458 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | type = size, size_out = 811 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 5884 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | type = size, size_out = 1383 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 2362 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | type = size, size_out = 1231 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1852 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 6241 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | type = size, size_out = 9503 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | type = size, size_out = 1606 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1988 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1872 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | type = size, size_out = 1452 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | type = size, size_out = 2503680 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 1452 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | type = size, size_out = 913 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | type = size, size_out = 596341 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = size, size_out = 5557 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | type = size, size_out = 27195 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | type = size, size_out = 67190 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 9352 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | type = size, size_out = 819 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | type = size, size_out = 1349 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | type = size, size_out = 596341 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | type = size, size_out = 819 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 2624 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | type = size, size_out = 4274 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | type = size, size_out = 16852 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 31094 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | type = size, size_out = 4274 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | type = size, size_out = 6421 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute | type = file_attributes |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | type = size, size_out = 16683 |
|
1 | |
| Get Info | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | type = file_attributes |
|
1 | |
| Copy | c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
| Read | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | size = 1114368, size_out = 129 |
|
1 | |
| Read | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | size = 1114368, size_out = 645 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 144 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 15072 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1072 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1072 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1696 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 786690 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1952 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1360 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 832 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1568 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2304 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 928 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1232 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1856 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 596352 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 5568 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 832 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 37696 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 26944 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 27200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 71248 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 9360 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1392 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2368 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 4288 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 67200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1616 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 3200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 4208 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1888 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 6432 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2000 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 16688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1888 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1360 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1472 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1472 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 816 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 16864 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 5888 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 31104 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 6256 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 9504 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 20592 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 8736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2432 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1616 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1808 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 11472 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 8928 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1856 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 8576 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 227312 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 39024 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 69056 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 656 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1584 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | size = 25248 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 19792 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2864 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 34928 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2192 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2992 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 20640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1568 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1936 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 27408 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 3488 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 33024 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 43280 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 960 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 31840 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 32608 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 29936 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1376 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 20384 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1296 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 20576 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 2048 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 28608 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1296 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 3968 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 25120 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 1360 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 32416 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 33280 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute | size = 242 |
|
1 | |
| Delete | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | - |
|
1 | |
|
For performance reasons, the remaining 1326 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (20)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 12064320, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 12064384, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 196, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 12080544, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 224, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 224, type = REG_SZ |
|
1 |
Process (709)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | os_pid = 0xa6c, show_window = SW_HIDE |
|
1 | |
| Create | C:\Windows\system32\cmd.exe | os_pid = 0xb3c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\Windows\system32\cmd.exe | os_pid = 0xb34, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
693 | |
| Enumerate Processes | - | - |
|
12 | |
| Open | c:\windows\explorer.exe | desired_access = PROCESS_QUERY_INFORMATION |
|
1 |
Module (36)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
14 | |
| Get Handle | c:\windows\syswow64\advapi32.dll | base_address = 0x74d40000 |
|
1 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x76c34f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x76c31252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x76c34208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x76c3359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x76c4d650 |
|
7 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CreateProcessWithTokenW, address_out = 0x74d8531f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64RevertWow64FsRedirection, address_out = 0x76c4d668 |
|
2 |
System (46)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
28 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
11 | |
| Get Time | type = System Time, time = 2019-06-27 18:45:37 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 101525 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15163991078 |
|
1 | |
| Get Time | type = Ticks, time = 101619 |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (29)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\10969C354B4200 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4200 |
|
1 | |
| Create | mutex_name = Global\10969C354B4200 |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
5 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
5 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\10969C354B4200 |
|
1 | |
| Release | mutex_name = Global\10969C354B4200 |
|
1 | |
| Release | mutex_name = Global\10969C354B4200 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #2: cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
98
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:31, Reason: Child Process |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:28 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa6c |
| Parent PID | 0xa54 (c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
A70
0x
A74
0x
A78
0x
A7C
0x
A80
0x
A84
0x
A90
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | 71.00 KB |
MD5:
e59ffeaf7acb0c326e452fa30bb71a36
SHA1: c88fad293256bfead6962124394de4f8b97765aa SHA256: a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2 SSDeep: 1536:zkGB8nHbKUvryElSpi8jCZGcqDKlKnr8dV+99rmuoENA4Cj:zFBMHRvrAjCZmKcnr8YrfA4Cj |
|
|
Host Behavior
File (6)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 | |
| Copy | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
| Copy | c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 |
Registry (19)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 8132160, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 8132224, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 196, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 8148384, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 224, type = REG_SZ |
|
1 |
Module (14)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
4 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 260 |
|
6 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x76c34f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x76c31252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x76c34208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x76c3359f |
|
1 |
System (25)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = XDUWTFONO |
|
1 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
18 | |
| Get Time | type = System Time, time = 2019-06-27 18:45:37 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 101806 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15204618563 |
|
1 | |
| Get Time | type = Ticks, time = 101868 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (22)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\10969C354B4200 |
|
1 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
11 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
6 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #3: cmd.exe
188
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\Windows\system32\cmd.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:37, Reason: Child Process |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:22 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb34 |
| Parent PID | 0xa54 (c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B38
|
Host Behavior
File (136)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
17 | |
| Open | STD_INPUT_HANDLE | - |
|
52 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
47 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 63 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 47 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\netsh.exe | os_pid = 0xb64, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\Windows\system32\netsh.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\Windows\system32\netsh.exe | address = 8796092841984, size = 896 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x76f50000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4a6a0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x76fa14a0 |
|
1 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-06-27 18:45:43 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 106923 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15864515968 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #4: cmd.exe
166
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\Windows\system32\cmd.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:37, Reason: Child Process |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:23 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb3c |
| Parent PID | 0xa54 (c:\users\5p5nrgjn0js halpmcxz\desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B40
|
Host Behavior
File (114)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
17 | |
| Open | STD_INPUT_HANDLE | - |
|
41 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
36 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 63 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\vssadmin.exe | os_pid = 0xb6c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\Windows\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\Windows\system32\vssadmin.exe | address = 8796092866560, size = 896 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x76f50000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4a6a0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x76fa14a0 |
|
1 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-06-27 18:45:43 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 106907 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15863073276 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #5: netsh.exe
40
0
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\windows\system32\netsh.exe |
| Command Line | netsh advfirewall set currentprofile state off |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:38, Reason: Child Process |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:21 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb64 |
| Parent PID | 0xb34 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B68
|
Host Behavior
Registry (9)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Get Key Info | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 |
Module (18)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | RASMONTR.DLL | base_address = 0x7fef8770000 |
|
1 | |
| Load | MSVCRT.DLL | base_address = 0x7fefdad0000 |
|
1 | |
| Load | C:\Windows\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Load | NSHWFP.DLL | base_address = 0x7fef3a00000 |
|
1 | |
| Load | DHCPCMONITOR.DLL | base_address = 0x7fef8870000 |
|
1 | |
| Load | WSHELPER.DLL | base_address = 0x7fef8820000 |
|
1 | |
| Load | NSHHTTP.DLL | base_address = 0x7fef8810000 |
|
1 | |
| Load | FWCFG.DLL | base_address = 0x7fef87e0000 |
|
1 | |
| Load | AUTHFWCFG.DLL | - |
|
1 | |
| Get Handle | c:\windows\system32\netsh.exe | base_address = 0x1440000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\netsh.exe, file_name_orig = C:\Windows\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\rasmontr.dll | function = InitHelperDll, address_out = 0x7fef878cf70 |
|
1 | |
| Get Address | c:\windows\system32\nshwfp.dll | function = InitHelperDll, address_out = 0x7fef3a6b6d0 |
|
1 | |
| Get Address | c:\windows\system32\dhcpcmonitor.dll | function = InitHelperDll, address_out = 0x7fef8871a40 |
|
1 | |
| Get Address | c:\windows\system32\wshelper.dll | function = InitHelperDll, address_out = 0x7fef8821720 |
|
1 | |
| Get Address | c:\windows\system32\nshhttp.dll | function = InitHelperDll, address_out = 0x7fef8811c24 |
|
1 | |
| Get Address | c:\windows\system32\fwcfg.dll | function = InitHelperDll, address_out = 0x7fef87e2d20 |
|
1 |
System (13)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 1332, y_out = 773 |
|
1 | |
| Get Time | type = System Time, time = 2019-06-27 18:45:43 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 107297 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15982949378 |
|
1 | |
| Get Time | type = System Time, time = 2019-06-27 18:45:44 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 108607 |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\Windows\system32 |
|
1 |
Process #6: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #6 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:38, Reason: Child Process |
| Unmonitor | End Time: 00:01:00, Reason: Self Terminated |
| Monitor Duration | 00:00:21 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb6c |
| Parent PID | 0xb3c (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B70
0x
B74
0x
B78
0x
B7C
0x
B80
|
Process #7: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:41, Reason: RPC Server |
| Unmonitor | End Time: 00:04:38, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:56 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb84 |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B98
0x
B94
0x
B90
0x
B8C
0x
B88
0x
B9C
0x
BA0
0x
BBC
0x
7D0
0x
774
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-06-27 18:45:44 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 107952 |
|
1 | |
| Get Time | type = Performance Ctr, time = 16209217950 |
|
1 |
Process #11: cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
8320
0
| Information | Value |
|---|---|
| ID | #11 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\appdata\local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:20, Reason: Autostart |
| Unmonitor | End Time: 00:04:38, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:17 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x4ec |
| Parent PID | 0x378 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
4F0
0x
568
0x
574
0x
584
0x
5CC
0x
624
0x
634
0x
688
0x
68C
0x
690
0x
694
0x
6B8
0x
6BC
0x
6D4
0x
6D8
0x
6DC
0x
6E0
|
Host Behavior
File (2433)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootex.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootex.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootex.log.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\bootsqm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootsqm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootsqm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\ODeploy.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\ODeploy.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OFFREL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OFFREL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OPHPROXY.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OPHPROXY.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OPTINPS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OPTINPS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\PJ11OD11.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\PJ11OD11.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\PJRESC.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\PJRESC.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\PRJRES.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RICHED20.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\SERCONV.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\SERCONV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\USP10.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\USP10.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\WISC30.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\WISC30.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FBIBLIO.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FBIBLIO.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FDATE.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FDATE.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPERSON.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPERSON.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveNoise.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveNoise.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\MSCONV97.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\MSCONV97.DLL | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.INF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.INF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Copy | c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
|
1 | |
|
For performance reasons, the remaining 1432 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (16)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 1857048, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 1857112, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 1857384, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 |
Process (335)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe | show_window = SW_SHOWNORMAL |
|
1 | |
| Enumerate Processes | - | - |
|
322 | |
| Enumerate Processes | - | - |
|
12 |
Module (28)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bd0000 |
|
12 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75be4f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75be1252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75be4208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75be359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75bfd650 |
|
5 |
System (37)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = XDUWTFONO |
|
1 | |
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
17 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
12 | |
| Sleep | duration = 60000 milliseconds (60.000 seconds) |
|
1 | |
| Get Time | type = System Time, time = 2019-06-27 16:49:30 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 23212 |
|
1 | |
| Get Time | type = Performance Ctr, time = 6661066961 |
|
1 | |
| Get Time | type = Ticks, time = 27300 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (44)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4200 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
3 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Create | mutex_name = Global\10969C354B4201 |
|
2 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
14 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
3 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
2 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #12: cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
23
0
| Information | Value |
|---|---|
| ID | #12 |
| File Name | c:\programdata\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
| Command Line | "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:20, Reason: Autostart |
| Unmonitor | End Time: 00:04:26, Reason: Self Terminated |
| Monitor Duration | 00:00:05 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x4fc |
| Parent PID | 0x378 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
500
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bd0000 |
|
2 | |
| Get Handle | mscoree.dll | base_address = 0x0 |
|
1 | |
| Get Filename | - | process_name = c:\programdata\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75be4f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75be1252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75be4208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75be359f |
|
1 |
System (5)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-06-27 16:49:34 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 27066 |
|
1 | |
| Get Time | type = Performance Ctr, time = 7045556787 |
|
1 | |
| Get Time | type = Ticks, time = 27378 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #13: cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe
23
0
| Information | Value |
|---|---|
| ID | #13 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:20, Reason: Autostart |
| Unmonitor | End Time: 00:04:27, Reason: Self Terminated |
| Monitor Duration | 00:00:06 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x504 |
| Parent PID | 0x378 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
508
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bd0000 |
|
2 | |
| Get Handle | mscoree.dll | base_address = 0x0 |
|
1 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75be4f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75be1252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75be4208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75be359f |
|
1 |
System (5)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-06-27 16:49:34 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 26722 |
|
1 | |
| Get Time | type = Performance Ctr, time = 7011076335 |
|
1 | |
| Get Time | type = Ticks, time = 27502 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\10969C354B4201 |
|
1 | |
| Open | mutex_name = Global\10969C354B4201, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\10969C354B4200, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\10969C354B4201 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
