MicosoftSearch.exe
Windows Exe (x86-32)
Created at 2019-07-07T23:39:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: micosoftsearch.exe
25256
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\micosoftsearch.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:27, Reason: Analysis Target |
| Unmonitor | End Time: 00:00:59, Reason: Self Terminated |
| Monitor Duration | 00:00:32 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x954 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
958
0x
964
0x
970
0x
974
0x
978
0x
97C
0x
998
0x
99C
0x
9A0
0x
9A4
0x
9A8
0x
9AC
0x
9B8
0x
9BC
0x
9C0
0x
9C4
0x
9C8
0x
9F0
0x
A00
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| micosoftsearch.exe | 0x00400000 | 0x00939FFF | Relevant Image | - | 32-bit | - |
|
|
|
| buffer | 0x00B51D98 | 0x00B69BE7 | Marked Executable | - | 32-bit | - |
|
|
|
| buffer | 0x00B51D98 | 0x00B69BE7 | Content Changed | - | 32-bit | 0x00B526C3, 0x00B51D98 |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe | 377.00 KB |
MD5:
d1487253cee49b68aebae1481e34f8fd
SHA1: 6e068c1f4078e3764229dbf6e6ba3412136e7304 SHA256: ac4a4747011aa436dda454c1cc59e5002d63847bdb67836589cd756f09c39f79 SSDeep: 6144:D4bb3UegtamZ87yJwLhoVK9fwlb9Zx/A:D4bbM787yytoVkwZx/A |
|
|
| C:\Boot\BOOTSTAT.DAT.id-9C354B42.[back_me@foxmail.com].php | 64.25 KB |
MD5:
cfda674c379bde8e9e139a020fcaa7fa
SHA1: 411a0404e24823b8a71c9f53bfaa9f2a649c1794 SHA256: 2b981a2f92dcef136fc9697eab54ac1c1a0d7a29098d18da02b048488fb2fb8e SSDeep: 1536:rL/F/zEky+7ZIF+hAqbSwf9X9Q3ExVBPW9jUbhXodmgM4:X/5yuZHbbSwf59QeBqjUt4Y8 |
|
|
| C:\BOOTSECT.BAK.id-9C354B42.[back_me@foxmail.com].php | 8.25 KB |
MD5:
0737dd734a4100208ac77b45c8c80bd9
SHA1: 73fc9edf9e48cbb6de6a0ecb6c75a059c43aa304 SHA256: eee35de7c073ea76f72599ea883d9e93b959d993692310a54af2df2bd53a4386 SSDeep: 192:FvNcVoSiCvTf7b27qKRPIGsJg4RKV1kF2yAiOe8VhWrRmh7Y:FvNGiUbpKlNw1Ane8P16 |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.76 KB |
MD5:
26aa56fc34dfc758b1e65c16bf1d7b50
SHA1: c8082d04c24452db3ad70ada262fdfc46179f65c SHA256: 1901336e0b275735bec35b9e39c7f5c173fb43fa7b13673ff261e2dd0479967b SSDeep: 48:rmfzMapoS95anGnAGajhih4etrsDJ/wjW0B/qej6ZYct15tY:+zXpB0G68h4GrGwj9B/9iPzY |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.47 KB |
MD5:
064a97ea272d31ed242c2367baed743e
SHA1: e164ab44b0c512761941ede30d386ac176b528a4 SHA256: 44b35f38bf6384a8cf10631179ab0e0754e53d1a9bf4c3045b0f33bdf491cffd SSDeep: 48:xiEFoNXs6xmyc8DLVrROMu2O/uXUmroqshIuvwG4YQrH61IS2C86ZYct15tC:x9o9s6xmiRNeutroqshIa6B+1F2DiPzC |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
adb33c45d5c365717d71ae58e88f25f1
SHA1: f3576c99cea6981d60ab63c35562c7d07b03320a SHA256: 1f92b1d541e91e31ba83807b7bdeb2b11c9d1a4abedb47ea46f358bbc792ee00 SSDeep: 48:o2mUcjPu/Nf649WYtd4hNu4oqt/EteO6ZYct15tS:ofjPu/B6Utwu4oqt/oiPzS |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.07 KB |
MD5:
68493680a9a22e5e71e7e2ca3188e68a
SHA1: 878fc4404e150c9a01dc74d14fa3c7efbbbc0d7b SHA256: 9b3ecb32e4805d9c3a0465db023aecbfa8d4514e01037021ceb04105ac578faf SSDeep: 48:+Pa8Wg1CiTxniperNlA0MWzl7lhbulG/Sr/9HzxaFKe6ZYct15tC:KYQxiperNDRzRbnSBzCKeiPzC |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 3.36 KB |
MD5:
06e400a8f7817f8641c34a0b0c67fb03
SHA1: bb616f6070f4d2c371f6865d3d3fc62eb4e0f25a SHA256: d18f63bfe7f12ae2f168cbf0f931cdda60cdfaada6762d4f4c88953cb65bfb96 SSDeep: 96:NS8mHYZeJMZF3sbizJ1ZcqAHCCr/+QasrXbLNppTsfiPzMt:oNGe32tvbW8sbLNppB7Mt |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 4.33 KB |
MD5:
e6a7fc6d876ddce3c8656c105c5d0d80
SHA1: a4b2dddf6962c9bb912f95c1835b34964e4f0455 SHA256: 7b9519520dd46fc827d5138ba78f0ff88a2c221bc71ccc1b060a8dad2d577ec3 SSDeep: 96:lrhRDVvYKwFxmIbT5FTr3uMF5FTT8RlONXc8QBNpiPzC:ZhRJvYJvP5we5dQ6M8QBNQ7C |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.60 KB |
MD5:
4f18c9a8289860a82e5ed27fd5bb6e15
SHA1: 75583d55c7669ff0f979e2702f022817ac39f08d SHA256: fe304c55313616408eb4fde4be241330dff00eecd2d1a8d0eac9d441bc516ff9 SSDeep: 48:e48pTWBHBEV0e38ZOK1hmoqVwx+NeqVGD9K4sXni8aWGGbnYPBBupnXZXjRSGH6I:e48VWLEV0e38xa3IRBsXiTGbnYPB4ZtF |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.99 KB |
MD5:
4dc1dafa458d781cf4af67a2c9b90c72
SHA1: cd7ec2118c52f7c47e927ff37e553dbe2a3a87ea SHA256: 2d78618fa37b5c6053c1f278e29bee702d987bba761297a4eb4832028cfbcd55 SSDeep: 48:3AgapP2GxLyuBOWeGiFmitr4s1xcIi6yJwiOYXIiq7e6f6ZYct15tu:+p+GxLHBneGilHFi6kKfiPzu |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
2b4202481c178839e02464bdd92809ae
SHA1: 2b83f5955ac8448c2c1884a1820a103d7ddc426a SHA256: a4a8e19af4603345994777014a508fa0778025fb458fc5cde4f39fd65a5cc05a SSDeep: 48:eMBDzd85zN3NqpG/bVIguXu0ZRHBeuX6ZYct15tQ:rzd0zN96Gz+gyZRJiPzQ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
3f2f73b78f968a4e42c55944c607c4c2
SHA1: e8512aeefa6770136586595e3aa187389b63c7ff SHA256: d23e2dbe5ebc931f237a112f10d236485e1f3b71728855096a34a53001854add SSDeep: 48:kpSEJlu/dC8ESNdSOKrjk6TuwZf/6ZYct15tC:JEDu/487bVYJqyf/iPzC |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[back_me@foxmail.com].php | 1.03 KB |
MD5:
51b931e98886c59dcccac91a5577269f
SHA1: a2209a52a0826d495c9858a0d155ef37d3dc93c2 SHA256: 65b001da04e585a229f7d5530e262af363c0d63714d5babda789ae6dc0fcdb94 SSDeep: 24:g7tw9kCL4rcY/c+vELhlqh8Zg1CqNH9K/WT75rdZq46ZYct1npXv17U:W3I4oYK+dQPe5Dq46ZYct15tY |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 5.97 KB |
MD5:
045081f0743d75472b6e792df119c600
SHA1: 5bb962f00ea3ce8ccabe83d9b64d096c77f5030a SHA256: 2416e4cb123a058bffad525912b9c4d1bfc4c4bbfa358c0fb8fe39827256719c SSDeep: 96:91/tgGjgjduUQGxq/LrYc5iwqtnzUGbYwvBSRVNTzaJaZI9ffBllvJsg06fg+xn7:zjgj3xULr7Ehz79vBoVAuI9xltiL6ppR |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 1.80 KB |
MD5:
4a3799c0deea99e3baee17a51b35c3c9
SHA1: f1a875b877730356110825e9d20bf2f5e74ab846 SHA256: 25617b4742b3b26557673a16e00f155968e4b057619203a83216b5951901b954 SSDeep: 48:B57GUd1h8D5YsmDs7UaKfM60g8w6ZYct15tC:Hnd1M5Ysr5T638wiPzC |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.54 KB |
MD5:
81167ed2ba11ec223fd237679ef34fc5
SHA1: 79a4f927e039afaafbaecf65884ff9a3f16c3082 SHA256: e2807964521e8260dd0c1ad701ed15e50cc2639a38c1a39097818243ff903646 SSDeep: 48:zcHzbGYQzgwLkPI6EEQP6D0BCe4T81E5CTjxueW+CUhGQYcJXditd6ZYct15tC:4/GVs0MInzP5/4TOE5CPxuYvbiHiPzC |
|
|
| C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.44 KB |
MD5:
6e83f22701254ee3bff8aebd17ff104e
SHA1: c658862d4a582530b88e098bf38a669f78dece17 SHA256: 9df7eb64f3f62b3899a30b4d639c7c95fed106637b7bc95200461aeae2a63cc3 SSDeep: 24:gKX9XZzw3UhyZv+WpSYp6oj2Z56lw8QEk02ON2RdHVqY8Z8v4ePv6t6ZYct1npXo:gQ9XZzpEoWpSYgaqOwckiN2RdHz4ePGV |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | 1.55 KB |
MD5:
bb5b56af15a8a7ba764f2bcb62c3d444
SHA1: 078e782744df068078f6e70af19e5b266a3ab1f1 SHA256: 1badcf92b6f6a40c55b79d95148ac4eee8370e9a432def76c02e791f0d96e86c SSDeep: 24:W9HDD1IqSjU7EAGlLlq5CahmfM82JLJBoWsiQzcQnLIpKwwHc6ZYct1npXv17m:WNPSjU4AzhmE8TW/QLIkxc6ZYct15tC |
|
|
| C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 6.33 KB |
MD5:
0a4a9c4c6cde4d272575b34146a440ca
SHA1: 76c87675c85178c15ea4b071bd639532045e3d3b SHA256: cf197306f41ec1f7aae3d003615a49e1d0ec86017fc30892a209c67290efe316 SSDeep: 192:Am5UpA/V2mpBQUvkemzw2MRcAihNW0KPgJxZuv7C:KqN1pqUvBmjLhNnp3I2 |
|
|
| C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 9.51 KB |
MD5:
2de17d94e0a08bb52074e8c763d37f90
SHA1: 84cd4c45d985d7803e5c97ae6901afdadb113708 SHA256: b27cfd0637137ebd39f089eaa13e1da2778bcbfdfd05eb055dbb312bdf279df7 SSDeep: 192:a4dHsqf7mlizYyBU/1FQhfeXasj06H3h4mQd6lea/qA7Y:RsqaqYQteKsjmd6f+ |
|
|
| C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.81 KB |
MD5:
3e0a2cce04f636192d03fab47b4e1ffd
SHA1: 89c33eefb2df2d4826ccc2c0f4d96386919caf9a SHA256: 28e245a85a2619d5a62561b7193d4c0296716689644dd1f1f53ed25fe7287342 SSDeep: 48:UBmLfjDcY24Srjg6kzVZESzQebK6ZYct15tMt:UBKXe6zRziiPzMt |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
a8e5b351656d1d6f66b4e5f384f8f322
SHA1: 6fa7e87897429ff1d13ae98d913f8926b4a46a77 SHA256: 81e1f9f9c08e2917b9d4962417152846a6d5f610928a85276108b51d89543993 SSDeep: 48:w4TASZIF8VqG9q1cD8b0ahwITxC7ce+wh+hL/qF/6ZYct15tC:3ESZocqGe9hPNTbDt/o/iPzC |
|
|
| C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
7bce8bc3a14fcceace16b8f37f036ec5
SHA1: 2bcc9b87ea216b50a2b1f93a1b39128ce24fd021 SHA256: d6458ec5c1dd0bbeb22b2d97ed43041072f012b3b89e6532fddb1bd6ed58be4e SSDeep: 48:ly51PLkWG5yTHyuGI2jQxUFAIxM+5zPSWet6ZYct15tMt:lyfDkWG5yxf2jQefM+5rSbiPzMt |
|
|
| C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.07 KB |
MD5:
42bfea7fbb935d274f535a10b2728e4a
SHA1: 2b9d1fc2d1ca999f973feeda8c873fe38f1d9f30 SHA256: c2dbb77ed7c31a35b8b1aa927d94346c8a759413c8cdfbdfcd28907b9286ebea SSDeep: 48:118HbRkl7+hxNCaqpAXii9PiRRkL+jLdHlh0UzxLxd5EzV16ZYct15tC:q9kl7+PMArfLWhZzxLxdGV1iPzC |
|
|
| C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.14 KB |
MD5:
dc498a3d0a11b17235754a6b17bc7609
SHA1: 3adc4053b6072ff2b9fa5639176c364a85247211 SHA256: f9ee1fcb1ef065d6c707d80ebaffbcebee58453a9ca6d56ff3e65e0bcc77212f SSDeep: 24:XgbHGwZkhcMIed6Bi41wBEACdsWe4Jnled6ZYct1npXv17+:bmkhcMHa31Tdhe4Jnled6ZYct15ta |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.60 KB |
MD5:
be904e4b10a0364928493eb72d747b58
SHA1: b8d9464c18ec1c390624316004e2e2830942e393 SHA256: 4d785cb3499484b53aed0290eed57c7915dbfec0ae1a39d9ec4f5085b4b0cdeb SSDeep: 48:BztP6232eDVBm2Xy3n6IP1HEareyW4f3rxtMQM1ek76ZYct15tm:BztP6232eDVA2XuZtkieyWk3rxtm7iPi |
|
|
| C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.04 KB |
MD5:
9cfc3b22fb7510d8292b4c0b60aed53c
SHA1: 1ba50e35340d925627a09b851cb6e2852b5273b5 SHA256: 85faba9cd63d5959ed22ad5f196f4ffcbc8d057e4eba13246a44136052b0b44e SSDeep: 48:dWfoIUUhEusnPMG9XpoSlhUfzZSUh8aHYe1V706XIB6ZYct15tC:koOfsPMGzoSlh6d82v7XIBiPzC |
|
|
| C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.18 KB |
MD5:
f7f6cb4a4ab842aaa6af8fc231f4bbfd
SHA1: c24b65ab83961ffae68edf8edbdcd348fc55dd0b SHA256: f0bb56c7d74938e8ba69f063c644b56fbfd796314c10bbd147d7664e8df78584 SSDeep: 48:uXckiMOlLCuHBp1HiKA3lFLe10Pk5Icwn6ZYct15tC:RMECgjHiLFLe1tIcwniPzC |
|
|
| C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 1.65 KB |
MD5:
aa8187f17bec30217ac7b40327210c83
SHA1: c2d7943fde3b325bfd74183c8a44d7bf70e2a9e9 SHA256: d14a9a767e3aa2cc589bc7344902ebb8fb3b6cac917c1a192f7921767f058487 SSDeep: 48:x8/4kyJEWH5rKDssjF9AzWt/tYufXFd6ZYct15tC:x8/4fJVeDsuXSWwufXFdiPzC |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[back_me@foxmail.com].php | 582.61 KB |
MD5:
081a9fbd9265d115933a61c04bcaafed
SHA1: 899d60ca4266b604fd4098b648b8fcb43edb05ab SHA256: b4b11d8a6d5dbf6f9fd57caac0cb38d4c993102eae02cebef8ab6fbb10bbadd4 SSDeep: 12288:pdUhIz4FQMqQNYrXAGCXb9xf1c+iZzAvzw4Fc/A1xlfyrlA1ms:pdqIqQP46X271cTzAc4yMl6rlA1ms |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[back_me@foxmail.com].php | 26.79 KB |
MD5:
c81a003d1f072310750196c0434a1885
SHA1: 3c83ba516526615590d7399f36c84fbd9e67587b SHA256: fe5484699c8757e8bf2a9447a443a2579ec8723e4be149cd4a0b98c2441e3ee9 SSDeep: 768:KNdY8ngtwx5oSqWxjS5yx/dbFNRp2bPJ2RgV:S68ngamWxjS5K/BF7pqh2Rq |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[back_me@foxmail.com].php | 65.85 KB |
MD5:
dd25182b81fdc5a9b06432e97f1c14d8
SHA1: 09346bdc2b3c453a887b581d4b84bd2891eb3808 SHA256: 19fcd1351d40a676f6265af3d2483c8fe9491f749319cf0a7af19a273f149215 SSDeep: 1536:Iw0SdBM0LbjT+w61lizWKSj5tckB34YzVujBWb0GgEXRPSzt2g2j:IwJU0Lqw2lCSjPcS1zVcBWbvgEXRPSzu |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[back_me@foxmail.com].php | 1.05 KB |
MD5:
c7ca9f38dff71f106aa83c256025bc4d
SHA1: da111b68d4e458c678cddc6614d7fcf365f988a9 SHA256: 627c9368f7a06907238c4d0257c27c77f6c628d547aa00b0e80dc9e7b9408e9d SSDeep: 24:ihrQxfL5dwcfpBLM2XSQrjSzFSOj2tA5hCPfOfS23ct6ZYct1npXv17s:ZxfwMBpj2D84S2U6ZYct15tQ |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 5.67 KB |
MD5:
10e226ddb7f7456c2d3c17d423075091
SHA1: 1b88b3937e986bb9d1711b1484edcb2c84d73ad6 SHA256: 8dd7df65d34d56fd4cd677458ad5e4f346ea285ddf206af263e7329bdf503430 SSDeep: 96:pDWMa8G9ALvVaJ+Y92iyhXsMvHsBpfJXBwr4t3uJIDm9n1lK/aiPza:EMB5Jad27hXsCMfJRlhuGDgnno7a |
|
|
| C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 9.37 KB |
MD5:
6c5004db3ca0d71820a4759c2a9be394
SHA1: 87d65add57d4c37bb308c739fafd33b3a6a12a18 SHA256: c7c4a35d066972994a2c96ca3806da90b081c7f211cd40efc57fcbd6ce8ffa58 SSDeep: 192:NcJ/HiVBIq+7Gb3eSb/mKUJBTckdw7GKPeTv7WYXZ0AbE1LXJwdp07C:Nga5buSbFUJN7d2mb7WYX2AbEupD |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 2.80 KB |
MD5:
aabf934e4d8948aecd108c760e1876f2
SHA1: 10242fd7493024ce45248bd080a8db35d34214e8 SHA256: c6de07ec20c280d2228a7576e866905c5d4b7bf0ff561b190ada624236df5b0b SSDeep: 48:8eg8+iCcSSjoBCSnhugnAbNYAM11w0HA0ndnnqHYdLEAy8fevvxNmko9C+8o46Ze:aXcSNNnhuwAbuAM1m41nnqHWYV8m3mnM |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | 4.42 KB |
MD5:
ee650c1a2ed7ab90d45a04e9b291c46c
SHA1: 9c49802a6dd28ab2ce321e45ecbb5ab9e42cae00 SHA256: 4ba5e2ac7eaa7699f85b20bd15290af8d5c60e6592f432670edf4e4c49101610 SSDeep: 96:MdGsSob3+rZ153vkoQNp/vRhkk8L/7+pCmXHku3g9iPzMt:qrbA3soQNpRiZLDAkyL7Mt |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[back_me@foxmail.com].php | 16.70 KB |
MD5:
28bcd58e786171505c4b057b3154c31c
SHA1: b89b049fedf557bf445edd80c41997b7ef5d19f9 SHA256: a43c89383b9dac79a5948083eb19b4ddada3996a09cd19895d24710c1c689430 SSDeep: 384:Ky+tl/PjcB2DvcH0bwp31lhJ5hqToIkPwBsP9hlyQSEtD/qj4YEjW:Ky+tl/7EuvCawpLL5pIVBe9byEtD/qjn |
|
|
| C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 30.60 KB |
MD5:
559cb1601dba792577f7d00e29e33f06
SHA1: 187b9c0d1e13e92488537fe0140190fdcf6fd1e2 SHA256: 0102191143d8f0b49fd327b31776e4a0ac7b34f3d7cb3013134e7de8986af295 SSDeep: 384:ShLpqp4/Jp6nn8h19PWgNJKMYGTWjBl+TxGtlYyLWo/xH2QMO7fJSXkmyxjMnH3g:Shkmpcn8hnPEW7MtlDWmSwxjMnx6 |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[back_me@foxmail.com].php | 1.05 KB |
MD5:
b12738f8cdba4b88b6294ec452f3e456
SHA1: 6d20b2f7e8f764fa60340219eff50f82697452bb SHA256: 967aadbf629708b41e1eec22a4c53626260e7c062afcefce2226d4015af8b04d SSDeep: 24:kSCTJgR8sw3IUoIgvB18HyoIZoC4sOhrhBWS2jjYXt6ZYct1npXv17s:kSCdgnUCvB6SL3CrJ2jjYXt6ZYct15tQ |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | 4.42 KB |
MD5:
16e33af82e16ac82a340dc8a6c34fb07
SHA1: 941995bc25865102da79c0ea9009fef197bd17ab SHA256: b18e3089ee3f67041f68bcb28f43daf5cd10317db35cb31079137410b8b60ed4 SSDeep: 96:786OHiuuAHCry8n4U2pkOfBcTMpVqVlAaB0BRwHQsmhiPzMt:7doifATmlEeop4DOB9smo7Mt |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[back_me@foxmail.com].php | 582.61 KB |
MD5:
9d1ac4ab649aade73f5a1f59651c315f
SHA1: 80b1dfb8e806d4a1bf56d186f8902ed5b21439cb SHA256: cb84914df057600d2ee6d5b6cdfc86985b292a50c5c0559370139ba407205e78 SSDeep: 12288:kybf2asZgvLiC/+z0+jP8JRUfariT/G04Gu0jvkCTXLm9bRxoYELt4tMifV4Lco4:kybfZsZgDiy7+EY0b04GJ1U7ontyMLwd |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[back_me@foxmail.com].php | 6.51 KB |
MD5:
5d886f460eb223fb26961f27c5117275
SHA1: c97028f7dbbd9f885445b7ed2f13d8559ef98ad6 SHA256: 838e0cf926e905ea757ffd9384f433004bd0cd7d7c36816fc34d992a2e127ee5 SSDeep: 96:Y8wKMxJbNNMnYQW+9EYbHGr2ymsLzijT3ZkwsbwlYhQ0FNAlTI5NnKC3Xzz8O7oV:YoIxNPQWMarhFijqw2rFjNKC3jzzJ7a |
|
|
| C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 16.52 KB |
MD5:
fc6e26951cff53a432d94cd4b6e66a51
SHA1: bcab79a60854508a15041c1a858ac5e1114dd2f9 SHA256: 86ea446c4a7bfeb7490dff76fbe222ffac67150a973496df7b16f4cbcc4b1252 SSDeep: 384:EqHY8gPQKGoKAyuyvm5We5RrpdyeTqXh1pdiT4mrMPPQUITy96yI6n:EqHY8a2oKKy8Dld5sh1PQKQU39Rn |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | 4.42 KB |
MD5:
218ce3786201998f917565dc29590600
SHA1: 28078ec66edd7debe65289aadcb805e1957fdb5a SHA256: 9767642b3bb88c5e325d67bc55a368d9f66419dde5ac33b8f4ece026e9b6fb6c SSDeep: 96:TNIkzjBr9/1VteSqo6NYeHiU7vlgGbE9xJykrRS6wDM5iPzMt:RIkZhtVtepFiCvlgGbE9amzLg7Mt |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | 20.33 KB |
MD5:
22e02b10648cf2cfc40d2209052f9955
SHA1: 1634ef2ca2ba8ebcdfd5c1453c582d592105f123 SHA256: b291a26d40e07c8e13c618640b44c3fdf53754480cf0ac632c0f1307a1e617d8 SSDeep: 384:qJBp2c3TsXaPSHNEOh1O9AwWl6g985lpcc+FWyIVDHyCfi+JwH:2PSTHj1Eel79857ccXdHyCf9C |
|
|
| C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[back_me@foxmail.com].php | 1.56 KB |
MD5:
7123a9b39cfa2b28b7536d7d92ee67b1
SHA1: 9babde5301f37f23764f7098f47abf13a9ec0c32 SHA256: c15d26858a36a123a8c4ee78c19260701bfbdac78c4df9ffa5618b6be521ea71 SSDeep: 48:PXiqLvrIWypEpDFI+XMrNnaC6MoRKeO26ZYct15ta:PSqbrIW6EpJsNKMoR1iPza |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[back_me@foxmail.com].php | 1.27 KB |
MD5:
906685a4e54e4952774cedcc091cd940
SHA1: 2183d0b0727db73266e045c0b6f4a60d45519a38 SHA256: b2e1739fc25c0a98e4e4588e031805b5e424b3ee152ab0f25b46565d79239f27 SSDeep: 24:sEIflarEL+/yEXfhKV9d/2pi7428ouMtOoueBXugY0If6ZYct1npXv17ot:sECa4JahKVDsoupovk6ZYct15tct |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[back_me@foxmail.com].php | 14.94 KB |
MD5:
3af4becc3a54a136f4513257fd93b4a1
SHA1: 26c2c813dbcffedc424ae2160c0eb11f2abb6ddd SHA256: 5a33446fbf3370b21549f56edc205af20884b072836dc43997f8d94e50690f36 SSDeep: 384:2XMvxK8vRywS94Wnpvl08/Aqmu5FHT6CGEpScRksY:2cTRFE4WpGIAqmufzrGSJ2sY |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[back_me@foxmail.com].php | 1.88 KB |
MD5:
86af10248c015f591af2d226f278e863
SHA1: 5678cd372c16abaf428586c575663f40034a6565 SHA256: 5e7af9eedeb9a9e6b2977b6d1d19349c2d96fecea91795ff71b6542308234995 SSDeep: 48:xVelrPDhYtKFPb0e0iNJo/sdF40k8DHvmJd39oykzOnf6ZYct15tct:xVaVYu0of+sF4N8bmgKnfiPz0 |
|
|
| C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[back_me@foxmail.com].php | 8.76 KB |
MD5:
bf0cc48f9d969a260dd8babaf62ae32a
SHA1: b99b1a9d27c24872a64970ff0f8e20cc6e45ba79 SHA256: 923ec74497791a5c443df2308ac76140866269c95e47a8af0042df2bfaff01d1 SSDeep: 192:EvR+V1nqtFcuqFUa34jhQffrWi1JiEBsFNWDfQe7kAaN1NJ+eMjU7Y:E5+7nqtFcuMUhQffrW4xB2GfcXN1NweI |
|
|
| C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[back_me@foxmail.com].php | 1.27 KB |
MD5:
a5469a062e4ae7939f16d9a4ecbd54ea
SHA1: dad78528e22c9e2e3118c07bd3198d479722525e SHA256: 85b210908966deb0833055d465273ebe7558bc1f015427432e80d8eb1d7797ee SSDeep: 24:X9+CrDMWD1qStJVvelejy+yVxTv6pKLUn5ji1K77LQEx0GK/BUE26ZYct1npXv10:ACp1NBvecoxTSYLM5jOK77L5K/BUE26W |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[back_me@foxmail.com].php | 2.13 KB |
MD5:
8ceb21de013c20ab8d7d9c8831a67075
SHA1: dcfd0a90ce3d85de7558dc659facfa71ff644f0a SHA256: 940dc53f00bb2f452f828a4cb7b64101e5e8ca0d7776f7ed01bb9817feb6a36c SSDeep: 48:/zKMb6FgZ1lK/oSpmlxt8IE/M9xklHUydhjmM5jU26ZYct15ts:rKMb6ynlK/oSgloakl0yddvXiPzs |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.56 KB |
MD5:
efc2c85ff02768cb62023a83f881ac1a
SHA1: dae6794fdb279cbef9732f440eea25277ecc3468 SHA256: c4063a607b985e118dc2ada7b1901f7b6295f15a4ea86d2d7c8bb49a9b9cf480 SSDeep: 48:JL6PqbSQj+8xKdUq329Bjw4EjtYFxxE26ZYct15ta:96Le+0KdUCujspY9diPza |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | 1.05 KB |
MD5:
3fae5db09d747f2ac365a029a355eac5
SHA1: 0027cc5f0e3cbfea189d5de264ed8e142f5f5f65 SHA256: 580751eb5bafe2d2cbda44091450c59e3541bf605ef6ff2a11bff89bda789720 SSDeep: 24:Sa4nS/BuGMInbLvUECy/HXm6bu2WrYwwZea9u+WS2E6ZYct1npXv17s:Sa4IBukbLTCY3tfWEwwZe0uI2E6ZYctW |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.76 KB |
MD5:
f0e7ec78e56f9b6af4fd197a859b8bfd
SHA1: f46a76397f1ecac9327db1a872cb5bb8f00f1e91 SHA256: 772ea7ba3c0ffc6b811736af4e18ded174c99628935d4d8fce2c24796f42fad8 SSDeep: 48:9ZaKUFed9S+qlNP7KvmVJCzvglpm4II6ZYct15tY:9ZB2+uPe+vC0lpfiPzY |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.47 KB |
MD5:
796c7b9a2d94ecd65c736086b698e87b
SHA1: 29ee5eef3653214a6b0db86a162a065d3bd0c451 SHA256: 4a0443879fbea02a7f6bd7e9338a492805b7b4d367431684e19808ab2475822f SSDeep: 48:maI/nfSd02Nhm7a9nQtqG6qglBDqLzvknnI//3V7vNk4wl6ZYct15tC:tKfc02NXFFqglBDCzsI3lRk4wiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.14 KB |
MD5:
5df3a630934e7852511508b898e54c5f
SHA1: 12b6315b3a5f4efb1b6a6b3bd37c828da6ef0ad1 SHA256: 4ce01220474164c2be3d4a7ca8b40dec734bfdbadde46433263988b3377de09b SSDeep: 24:NpC4hsts2pmIIs/UPQ+IoSrBaztH6CtBnsUO3RuxrKHmo62X6ZYct1npXv17+:24hWBp1IRPLBustH6C0UOBU2962X6ZYn |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.80 KB |
MD5:
d602dc5e0df354ed90064274f0de02ad
SHA1: bcde260c7aed54f3a16a55728a191ab989642929 SHA256: 5003122739b3d758cde65c37568daaf8bb7412307434175187b03b5d673a29cf SSDeep: 48:u2va8He35qDOxUcpGuhVYVhLlWIYcJb7tTKvDr69bUlfg+OkCxNMIaN2Z8+BRdZQ:u2vsJqDOxUwGsK7WIYcj269b48LXRpHQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.44 KB |
MD5:
595c53c97a5642e2ef597f76dd4ff6e8
SHA1: ce3878eb8e1557473714818203989852d7fffe47 SHA256: 20177883e828473672bf0b4665d1d7bdb8d01a0023c270c0878c1a0c6c557c6d SSDeep: 24:Ye0gG4V28ksUGzJEraPdXJ3F7Nt/QEyNkUNThyJyI62Vd1g+OG7jY0/uz6ZYct1u:v7GS7J1lRfrqdujdOG780mz6ZYct15tm |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.04 KB |
MD5:
cfce8559a18518ec978ad538fe96cb46
SHA1: cfc1b78792fd1287b0aaaf06a7e7a6d40b6f1091 SHA256: e82fdbad1e0078d9f3855cddd20cecaabf425196dc31e5e0edb369d8c23deed1 SSDeep: 48:18pNga8tU/GAyKuOgaXziAMXZSp81DsYkbSV566ZYct15tC:18p+LUByKuOvXOjEODlkbSV56iPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[back_me@foxmail.com].php | 69.80 KB |
MD5:
e081e0c109b875d9eb5a6a67a6913e8c
SHA1: a6e674603b8a1dcb83ac31dd83d074a6221ac705 SHA256: 1ba26d0961342711e9afb55f2dd3ea3f7bfdb3603b4d6a6b36aa58596f98481f SSDeep: 1536:bnkDGAV/fyY2X4VEHqF7WWuYWf2wHfox2y0sSJqi61uLs1JK9Nd7WNQPjx:bkDnVR2X4VEs/uYWOw/ox2Fqi68LsTK7 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 5.67 KB |
MD5:
896239c95033746da5b0593ab76e2981
SHA1: e38d71abe168b0e78dae14c2fc6b3620fd31aab4 SHA256: 64c8a5d729dddc477e37aba47ee94a824f3735b621f520568a8b560eda0ddf9c SSDeep: 96:nw92gB7JS51HDerGmU4lPiiMibGRQpKsPEZr/GScdMYHDTiPza:nw92U7Q/DerGmUCPWWpKQEoVdMx7a |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 1.65 KB |
MD5:
8c0654a99d2014b1b6f75ccbc9902160
SHA1: 3e15f188c22c02ffdb83f7bd9e3d9e03ab75bd5b SHA256: 6479c599ce4ba296073bd0c87603bd06f350fccfcf01796bec552e6e7dd38da0 SSDeep: 48:K4uOLd/4bxrjV1zTqrmo9tf1wW8wmUPJzKs76ZYct15tC:K4TqV1omgN1w7/Ud97iPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[back_me@foxmail.com].php | 37.04 KB |
MD5:
746912baf4c34204eda9be1ee5345411
SHA1: adcf9cf39d2a29054c23bf7a23c15426b5bea8f1 SHA256: 334ac196827e472e6f6f386169a58fb9d2de1c0b2fd343ca3732ca91694b8d8c SSDeep: 768:+I5GQDZocy6V5qc12MNuVEYyS6BqkhWSml/QQqPRwmF/kuxEZ:+q3Zoc9V5LoVEIkhsTqZwmF/7EZ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[back_me@foxmail.com].php | 26.54 KB |
MD5:
013834cc4706c1a5afa6c74b44bc4108
SHA1: d40c28d73ddf1209a4d72ea8ccabd6846a3d39d1 SHA256: f14a8e7ae1fade5df2a6575c3c1b08391e27da1c7558a3faa40f9397ec009f4e SSDeep: 768:DpMknoaVDiv1JG19NBYEkwTXvQ19vvuboGuOEPoC4Nep:9Mknoa1uE9NBXkwTXvQzucGJeoCqep |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[back_me@foxmail.com].php | 26.79 KB |
MD5:
6e79a27b13f038c0b092d26ef063943e
SHA1: f5b1a40592ad5799200674f71b590ce5dbaf29b6 SHA256: e63ea34435352239a238af8099d748f94950efedcad04a7eae9e38bd2b83ef4a SSDeep: 768:e12+7uAWyJct9sNLJskMlcQdaBDrfXDrhOMu+HshWfdTPDt:e0+yFyJk9sNdMxaLZu+7fdTPDt |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | 1.05 KB |
MD5:
0485b3846594be1c954732edc73bc455
SHA1: 364c7297b8df8b05e8a9e7b53d596b6385c3a1e6 SHA256: fa97e40ce0fd2d2fc0ae53c394600e02a52a74b6dc82bd98743f4c11fd965cfb SSDeep: 24:kpqH/bFL8MMOZM/CbnAAirWUD5MLfZXm3jh0S2e6ZYct1npXv17s:Sqfb6MMOZbZ6Wa+fZXUuS2e6ZYct15tQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.60 KB |
MD5:
f3164b82a0f2caf12cdf51018b029959
SHA1: 01837ab3b8a46df72f170487a44923ff4fd8dc33 SHA256: 0b6131bbdb2ddd2e1615e982c6560999e09242844dcf7dfad79dff12c0b36275 SSDeep: 48:5cN8jHe2t/n4An11V7YfX966lev/9gU7pix1G6ZYct15tm:5V+6nn1V75p317piSiPzm |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[back_me@foxmail.com].php | 582.61 KB |
MD5:
6e3d22f5b14d499e52bacfb250a446e5
SHA1: 9a04b9e815c7be42f6af8742f23b44419eacb22c SHA256: 18ea92d639a5a98dca495cbe2a650dfed7cac8e6c66ecdee68bc3d258d69da79 SSDeep: 12288:gvWDuwWAv1L1drXKuwDirtPTYpkU/6fNds2UocowzqhfjkvJ:5/ZkmtPTuQdsloJfa |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.54 KB |
MD5:
27ff03a7c9ee971abbb8e7e7571049e7
SHA1: f45664deefa715a711da991f0a804f5b87ff8b80 SHA256: b70d30679ab6d682bc80905518320d24a294d91e2c12e40de6756d6c78c5b530 SSDeep: 48:VqFc0bR9ei8UgVfd4jJiKLKuhAgDAXsFQSR3VhbcdzKmPe+h2Q3avOJ6ZYct15tC:VqFSiFPZhvb7Rfbc1Kx+hd3wOJiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[back_me@foxmail.com].php | 4.42 KB |
MD5:
17645749a81c9d4f2a018ce252a81af3
SHA1: 3bdfec5c5e6709dc9e207d6ad6bb152627a95c5b SHA256: e92c78eb2c1442d843ab4795a9becb6c1c5ffda54e549742085a8a723b96c107 SSDeep: 96:DGNAHw6JM5OaE8jDo1hHH6NZoXnNYeaKORJVZqbXewhHxFiPzMt:qNAHl2zTA6leaBRJmbXewhRU7Mt |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[back_me@foxmail.com].php | 65.85 KB |
MD5:
aef024009caa17bba7295e7a571ad6cf
SHA1: 6c20ac0294916eb0e7f19a14c95dcdb3f01b3d39 SHA256: 15ccb0cabbd7b1629a82b27422ffb5e6085029507354d548eba9102b53022007 SSDeep: 1536:4GAnpoyYt6b4Z4oEGJT3CcTJ332kOYPJ4dh+/2Sxf8bACl7eGu2:OnSyYt64rXJn2LX+/CE+ir2 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 3.36 KB |
MD5:
658c9d0411408533a1333669c3ba090d
SHA1: a38b881b2fed258aa22cb7fff99adb1523a9372d SHA256: 8f5166c29ff0c319a1400c2993bc366ca20be852395f8e77684bf70b4120a89e SSDeep: 96:KqytYfh90ZXPXw6weX2sf5vSOQv7CUHCKniPzMt:byi0ZXoIXJvTQv7biB7Mt |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 4.33 KB |
MD5:
781f585a6cc8a1134372aecdde3fa8ec
SHA1: 2d0b2616e05241987b709f3349b9f12fa72ef2fa SHA256: 6948c2153ee77aefaf694b0a69ddaa42f432e2c376e5f80671d556d0415c1dc2 SSDeep: 96:RSRIOEZGciwfkZeRp/0oFTi9tSS0I3YxP9k/b1JykomH2nmQiPzC:xVG0MZho9mn0IGP6TbytmKY7C |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
8d18228357b7ca699f80d563c21296a5
SHA1: 1048949f6d53cf2aec92f83e82b0cdb491f1e445 SHA256: b29d405d27a9a9c2bcdafd485763f5d5280e81aacf63136f5b0041017eaba433 SSDeep: 48:zI4E1zHQRnNMkCBupvA5wb0/yNtVf6ZYct15tS:otHTANA5V/yFiPzS |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | 855.24 KB |
MD5:
b4ad1e1909e18d6f7601c9db9a87345c
SHA1: f4008a9250700df6711d8ef07e27e56c5dbd3b49 SHA256: 31b5d59ebc341265ce76ee2f893fac2502398ede8deadc3ab17b64725ad97a25 SSDeep: 24576:y3bXW/la+4qIqsrYFhl70W7sfGMJ4+uI2OBqr06xErO:OXCj493u+uNOBqwQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.81 KB |
MD5:
dd00df821012fcbf5993797e3c0ed520
SHA1: 6136b5109cdf4acb55094e10c49c4aebf0c7bca8 SHA256: a113771094757e94fe9561a59fc3effe83fb3e0d77a1a750db896a573945abc9 SSDeep: 48:TScJwdEwyCkvAou8uuyCu1C5CMOfEH0iJH6ZYct15tMt:1JjwyLop8uuyC1CMqitiPzMt |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[back_me@foxmail.com].php | 6.51 KB |
MD5:
396400f9c07561b6ef3f0a319d158803
SHA1: 828444172aff6e967b20ee5b5fd6dbcfda3d6ebe SHA256: 84a4eead20eb37a6a3327c738841f73a9187feb12c832de5aa1cf91bf5fc3a98 SSDeep: 192:YqAU3+ezcXO9Yogg0VIbS7Pty6IBgpRwqG0M7a:DAU3JzIOlW+b6IRB0wqG0D |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 16.52 KB |
MD5:
a981730faae667a034bddddf3ee04abd
SHA1: 9bec2e6df84271d19ae18c592090198d99d1072c SHA256: dbdc92df85483a085bc9a2ac5ee4b0044dde3fc295de2d4da3437477a5a47923 SSDeep: 384:+a9JFux4tfJ23rqE1a3KP9iNLqIZa6a3G+B1byEdEzJH3:/uxSe/1FiJVZza2+7byYEzR3 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
ba73859682be9d6c99b32f890e9a18be
SHA1: 814bca209ce1a6a4c22e3b9734f7f664ac681958 SHA256: 2255e3c8464a707419f1f1b8a71b09a8a14b65a6c8b399f077d8ce7f8e0e3461 SSDeep: 48:plyz0YBbdg2BsHtWFUPgxLelFTiOlte6ZYct15tMt:plyzNrgezaPIeXMiPzMt |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | 860.74 KB |
MD5:
a2a2b506e2e95d849002685928e858b2
SHA1: b92d9f5056cffcbe287f23dc66e714a3f511206b SHA256: a8a3629d71293b0a2ab49824546b34571312c528d539d07d2ef990f1804d1efa SSDeep: 24576:A0xC71U+1AVHvMgxqsoimIm3NXGgZ0yWZvHjP1Iy0n:Oa+1AVHkgdjZmdRsZvHjP5O |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 9.37 KB |
MD5:
b00af5bc13ed219ac28d1dd4e6917518
SHA1: e52de4803a6d6358d39241b6645e37a0aa1175ff SHA256: b0e4cb1a60ec2a615a9941297dcc9ace23c6497579ac7b39d4dbaa345cd48b63 SSDeep: 192:JCIVkI7RCPyM4yxIFqPuQLOm4slY0ave+uY/zY+oTpJVZJ+rIsB0lCb5ZwOELnc9:JCBn1RZCmXlY7ve+rYrPTs1ilwZFJJ5 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.18 KB |
MD5:
97888f811672d039e1778224f3b9d2e0
SHA1: 5bfffdbf6e1a30989d0c58525222f8e4933b4cd8 SHA256: 871a530f4411be738045698db582494c498fcf58962d5ba26c7d8702a9b0a8f5 SSDeep: 48:xxTqlSycHT4LCGFETlz57XbnEdh7488Nyl56ZYct15tC:xxTqlsz4X8lF7gdl488kl5iPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | 1.55 KB |
MD5:
4ac8a145983776e0faeafbba388b8056
SHA1: b7a25f83502e98b2ff34d3db45120ea3e6b25c29 SHA256: 69fc476776d45f8cf0cf9114dba8ececf06a5f5e7f16076987983682182243a3 SSDeep: 48:Gadq07bZoYRLyAJff3DdnYw9aaDjyzRjU6ZYct15tC:57beYR7JnFzqoiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.07 KB |
MD5:
97f2711cad6d18cf7223b6bb96d0607d
SHA1: cb5c4eec975981ed924a278e317f96af63fe2335 SHA256: 0943ad0bafb15489a1048228fe2c5f0d9b2f50d8aac1c0db788b8b4d6003fe4f SSDeep: 48:oyz9o5kFp+/w1i5ucJMfBmYMv8uCwcGzH9dMw6ZYct15tC:oenf+/wi5uc5h5rcGzddMwiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
1e44ba946afc4e4252b0933cd657d413
SHA1: f9d4cef10dd4b09d5c860e77111bf5f880018fdd SHA256: c91e77f18d09d21dda64ea1ac579065a7b3a5157d5c94c98d6b8527b240cf98b SSDeep: 48:/Avj7lulmDS05hr2Jha+sLpkIoBzHjR0uPZs5a6ZYct15tC:yglmDSE23aeBzyaiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
82bb9f8e5557ee40ac9f10e0a4727f12
SHA1: ebaf078cbbdfa6051d0b6a1edf3189da780fc760 SHA256: 15a9b5d2f86eaef01a94294927dcd64f266bad271c8b8911f202c1c816538e49 SSDeep: 48:KEXzV6CQyTUwEQ9Ub2JXDrbEvd9RlZ1bKI6ZYct15tC:KEh6CVTUwnztD3ET51GIiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[back_me@foxmail.com].php | 1.03 KB |
MD5:
d01ad409294143ae908e312eee062930
SHA1: 84e8ec92e2923a555421f8fe27cd54f36d7a065e SHA256: abb6d30cdaeed8c1a21fac1526ce71c4cb82f9048303e36a93f07d61f87d2c8b SSDeep: 24:gaMoGtwEq2Q2Lkb/cLt7zMsOK/L4zcPDZHrhXoobo6ZYct1npXv17U:goGt+2Q0kApFOUswrhNo6ZYct15tY |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 30.60 KB |
MD5:
266a3b97f51ef335e0534a5e4222eb7e
SHA1: 779bc4466593563c4f8ffff5870e96acbc23d046 SHA256: 50b1072bae4e8f803a3c20d807dd5236712a77b5b04ac7369d628bcbebb7760f SSDeep: 384:kaxl/9R3kaGJ7msoJ5ceMXBAVFLW+OKh8x6WBztMeHEJgDI1zEsmLd6s59Jno0Ov:Fx3R6mwe8B2gw2RB+eQdzoLoF0OuFK |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.66 KB |
MD5:
d205f166c9187573450afa4653bd242a
SHA1: 17301162a03aa4eac2082654f3d5c13dd6d78b92 SHA256: b366269bf9e1dd37db7b24a9ba9450b608541b0f9eb0a6cd0051662cd794049a SSDeep: 48:0rBphMWggpsc7pl2bOuzKkhd4LdwdR6ZYct15tQ:0rxM3c7pl2bOuOk8wPiPzQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 5.97 KB |
MD5:
01e086d7f1dfc0de06e2a4286ae83d68
SHA1: faba56fdc217ebe31322c4a674a6019b0e8cb38b SHA256: 634b3f473386129ad2aa24a6d9c983fc28820ed906014b45cb865b14afa9e42c SSDeep: 96:mT8JZIohUeHlCChlIamJBf11jGXGqs/tcOa47M3f0LaNy7rG4TftqS8ixBBYmL8g:dvUDbJBfj0GqsZofqLNDs7ixHxPJrmVe |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[back_me@foxmail.com].php | 16.70 KB |
MD5:
830691b54c73c535984fc362d585db42
SHA1: a7802c776e219630aab43555f649619174f540dc SHA256: b79592eec137e8519598e9edf0ea50730d6f1a6818c409d592ed8e5bcf634cd7 SSDeep: 384:9A5WJhLWy9RAbz2hzK5jfYQ/27pYArQ6YwPqB1EughysQsQuwbYsrFH:9A5G9HA375jwKCjrQn0JYbYsZH |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.07 KB |
MD5:
51e90e12164901c4cd8ccc51ce84b020
SHA1: a9f79e08a312dea89f65355a19fae01b8d7abc45 SHA256: 1f9f4582ab23a7615d73d361f5513590fba4ee42d2ffc70b34922dd5970d7dce SSDeep: 48:hm/rOY5sJTiwHuV2lVWh9rVXB1mZYhDtL0x3CVCeDOwCVaOn16ZYct15tC:hmOY5wT7YQVkrtB172CKaOn1iPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 20.33 KB |
MD5:
ae0b523b0f81b3535170f35392430cd2
SHA1: fea55d31821bf976e21d38249e52199b915885a8 SHA256: 439eed7077566acfbd3764faa945fe55c9bf907fd8975a45773c69a37f852a15 SSDeep: 384:iD0BNym1Nh3OHGu9Ju6BjABbMH0A7nHzl93MvjonRAlfaXIYlzZ:iDiRreHGO/pYIFHzjUjsRAFaLlV |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[back_me@foxmail.com].php | 8.76 KB |
MD5:
486daf8f466a37c9542c3485bf0e86fa
SHA1: d97e7c156162198022762468ea71d29784eb3a4d SHA256: 31de6fe3dad460057d6b8d3621e37944663cec832576aa8a0fe8c40cf4be4075 SSDeep: 192:v2w8CsRzJY23IAkK5Q/g45wKSmlj1zVUgZn+hAySj/Rq7Y:5mSK5QT5q21zxnyrS1/ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 2.60 KB |
MD5:
fcb65d69f8bf203ad1cdcc01702f7446
SHA1: a65d90d4be31d3a36314c8edc9c89bfb80e5a168 SHA256: bca69e963a35dc6dbbce48c73e92f35cd635eedcf3157da113a58c315f04a30b SSDeep: 48:01Fv6TqO3qXXfK67YuImYTIGKpWOx/nB1BqaszzmCXa4H6ZYct15tC:01JccnfK63YTGx/Nqjzmv4HiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 1.80 KB |
MD5:
4e1ee84aa97bb16d93650c0dce5aa9b9
SHA1: e70d24e00731fb3cb209efe4c66bdbf8fd2dd54e SHA256: e25eb4648831c0a6dffbbc43eee6721e085243904008144ac58fe0466a85bcfa SSDeep: 48:IJ/N9cyOsdiYd9sfOs5Zy1MRTwjo0+qfkW6ZYct15tC:In9mDYYy1MSMXWiPzC |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | 865.24 KB |
MD5:
70ff66a908e0527c2a2d5994c7baf101
SHA1: 7c6d5dfc6a07f673b6995b400ded7b75bdd43a6a SHA256: 6470e9900be05506cfd8961c6e359bd231e67c7638465162ce9a55053201e737 SSDeep: 24576:i0Dx6h8Ak61UQGBYi33pTU4B8mN0ZPhtBcetyMzCmSumTrA6d5v0:iwAkTQGYi3prN0Z5UBfumTUss |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | 6.33 KB |
MD5:
48ce635a4c4d44f3ed9f22c3bae63347
SHA1: f47cc7f56d56968174352da5698e44aefafa2030 SHA256: 87af5e853c1fb90b3f5ffb2f986f14e0548f547c5d2aba92d081d55596fee3b3 SSDeep: 192:lM4EkJ16NcIzBUtv1RvJxJ+DNJ3oK9K593O7C:G45GNcNtdRvJxJ+DNJTK/l |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[back_me@foxmail.com].php | 8.94 KB |
MD5:
9f21dc399f85ddda532c9f0fdd6cecfc
SHA1: 79f50f5871f3e44951032fa350b373b45a36c211 SHA256: ebfac267e01f993f33411ed53be99014635f55fb7840bbd1defd609fd0377294 SSDeep: 192:j3EHbwwRKmn/KNRs7jvng7mDqrUDwntZIuHSI/pVT6SG/Tf3g7C:j3EH0w0m/KujvJDaUwnf5yQ6SGrf3P |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[back_me@foxmail.com].php | 2.04 KB |
MD5:
94269842824ecd97861fab4317ad96d4
SHA1: df358224a6101eb8a3506cd3459ceb7afbb05dee SHA256: 5a45495ed4e3d3ac4a9be308555c58fdee8d97c9a46583550ce7d9bd5bff24f6 SSDeep: 48:fr5BV2io5P4ABQ7Ev/085+P75mKa/2n/goLj+q6ZYct15tC:Tzoio5QABQ7e0u+D5mKb/gzqiPzC |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[back_me@foxmail.com].php | 38.34 KB |
MD5:
49ce95f15543ae40cd079bb86c4839a1
SHA1: f659ec3ed5518de104afabebbf7a90ad3cde7186 SHA256: 48da234345f767fa114f65825f7bbb4bd3b8b143845b434c7344df03c3d35bbd SSDeep: 768:SsfGum0TsS3+SNosADUncs1RCCEyQ6V8zaWjMY:ZjoSOCoZCEx62zaWAY |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 1.99 KB |
MD5:
3d9f730c41ac6d0690779d25134f83b7
SHA1: b615ccc3d81cfa4f0840508c6f1557a1568b4462 SHA256: 9c152c7bebb62f6699ebb93e42177c9435d5b9b6e5c7da2afe7faa127af20c92 SSDeep: 48:2ZqN+CMaOHBzDgkBkwvFMNwADlYuSOzht2BiE8bQXZPf6ZYct15tu:X+h1HCY9M7BSOzLUD8kJPfiPzu |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[back_me@foxmail.com].php | 848.75 KB |
MD5:
b844edb13bae5559511e51d67d5267cc
SHA1: bbdd159f7e3eab2b171d76a07b8cdc0ebb0d146a SHA256: d1e3a40185738e27e28ab84cc58327c9eb47e2d2c16fe64a888b308112a7e988 SSDeep: 24576:ZGlXVUWf0NgAgfwOArotnnBSJCG9eSw50CmvjY:4pVrf+gTfwOUozNG9eSw50f8 |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[back_me@foxmail.com].php | 11.43 KB |
MD5:
066134871a0afbf3d647f8ae605cea62
SHA1: 504ec9febfb4415684b10ef9d1e9f87d454db4ff SHA256: 5720877f1204d0a48ca4a52d3208e97306996a4a302f63c9a69aa089640302df SSDeep: 192:roibaA2KkkJ9tJTeVsTPa4pIs0D35oUNYsot1yUyqW1WiUfrBugiE7u:roeOHkhNeObIs0jyUNKJ0TFgQ |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[back_me@foxmail.com].php | 8.60 KB |
MD5:
5bec60a21263597b62eec131a8783c8b
SHA1: 328a612607d5137da5f0cee6eba2cf986d25a82c SHA256: 05ffd03a295f56b4d84e285226358e9c01f873f437d2c3ea0e0fcf32e8f37ab0 SSDeep: 192:yKHzCDT6Gwn80eGKLw0I30HTAvArPHRbgCDv/tmX7A:dYufn80n0lzAvKHRUc/0k |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[back_me@foxmail.com].php | 222.21 KB |
MD5:
9d51ca2219c9aa41396bc55c02b1c68f
SHA1: 2a6c09332ebc9b32cdc329444633844c2baffa4b SHA256: bf41fd7bf204539a4734095d7016b318931f072e75f42b178468061609caa364 SSDeep: 6144:lAlgUnkALybucwvq6HewHhZ2H4UZV7ehP/d98Mtq:lPUnkdbfVwBZ9cKlfM |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[back_me@foxmail.com].php | 9.51 KB |
MD5:
adb8cf37f3248dd0e554cf410f615125
SHA1: 18b6258e0f8d406ce21ad082e49f5c9d3896d64d SHA256: 4baaca5cc7ad32dae273384b55479bf2f00b92b546a5ee4d499f89121bfd3fd1 SSDeep: 192:D0JSD9BBTAcV2BhrDhqGjWDrac+2nTMamrnY0pk3TPKFU0Y77Y:DvD9BRAlBhpq+W/acJnAakYak3AIY |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[back_me@foxmail.com].php | 890 bytes |
MD5:
586252360bf71c295582d416994cfc9f
SHA1: 19a20a4c11243cb1525707dc989f4c093b17a160 SHA256: 29e4e9aec6a29481ad49b4a6fc859ed0dd29f4c1fd655b7195bde862a50025bc SSDeep: 24:NMCm5A8ij3nDlGk9wtuPpn5SkwKA8FRNuMXQe26ZYct1npXv17q:Nr7XDlx2ts5c8/N4e26ZYct15tu |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[back_me@foxmail.com].php | 2.85 KB |
MD5:
af8c0911cd2fd67cec904cd43a02cda7
SHA1: 92453865945ed1a4dda24008ae2f067c49b08426 SHA256: 39895dffd09585ff4bbf5591fb6c8d0c855b0d7091587fbce1c4b93d7d985b27 SSDeep: 48:TBB8ijOHPiB58eEdYQwQZ2egBIq3A5iL+F5oNqCb52ODlyO/SYlA0U66ZYct15ts:TzMM5zQYQfAL+ULg5oNqa2s2j0ziPzs |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[back_me@foxmail.com].php | 853.75 KB |
MD5:
1bd41a287458fb067ecd4f355bf9ff0b
SHA1: d860fbe3a3b3c253939f6cd7568ef6efd1ea4687 SHA256: 057eebd533106ee0a3f3664562a0f883a526ef9bfec5fd1ae8427731f1be76a5 SSDeep: 24576:VLTWHsyUFDOs2uBvS23d9HfpN3tpRjlx3L:pTWHLtsKalH9/L |
|
|
| C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[back_me@foxmail.com].php | 1.13 MB |
MD5:
937f682e494440dfc42d28a6f63b8665
SHA1: f47c764abe08076c484f13fcb43a27bfc55f4dfb SHA256: 3319eec67b9a3a6cf266e7867227466c9970c12ab6d56213dfa5b3dc3144bf59 SSDeep: 24576:lFrI7tmPr49kBOVJR00j1Gg4Y5BumegcA5n38:HrI7tmP09k4J3j5Bagcs8 |
|
|
| C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | 378 bytes |
MD5:
8d7f63c19f16b659b917ddcdd4bfda31
SHA1: 1a9dd3a0732e0a35728f1913e582d54f46bfb2d7 SHA256: da6223830802dc2674ccbed48f65a62f248bb5b19269ef29dd155cbc52a88b38 SSDeep: 6:OrSGvIosvar/UwF8hwDH4ts6WCVf1EY6xXssL18Xx3Bgt1PZhj+UHXv1UaSY6t:kQPvarcBcHgHf6xXz8Bmt1PZhj+YXv1u |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[back_me@foxmail.com].php | 16.94 MB |
MD5:
2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07 SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4 SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai |
|
|
| C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[back_me@foxmail.com].php | 3.14 MB |
MD5:
7aadc13a6b340d0912fca34efb6e278d
SHA1: a682707d004389bbe464f98b5c395f52209a95ba SHA256: 44395073c9d5232ad1a87635cfc1e88fff1283388a6708a7114d18b7b99c14a9 SSDeep: 49152:zDxL8QBo0Tex4S120ytJylfySe+Z7j9uBL:zR89t1tfyP+B8p |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[back_me@foxmail.com].php | 3.14 MB |
MD5:
45492979471c5633e724edf45a13a25f
SHA1: d6fe5b982ff04cae2cd67222725414e13e126801 SHA256: eb71ecd973e5e29f8f11cc27c44a4211d9c2708bedbb013a924f99e44179f9e3 SSDeep: 49152:zDxL8QBo6Tex4S120ytJy/2XvJm+xdUkxp:zR89j1H0Jm+3UWp |
|
|
| C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[back_me@foxmail.com].php | 67.85 MB |
MD5:
6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774 SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[back_me@foxmail.com].php | 3.15 MB |
MD5:
785e8140291b81280ac12f751e0df5ba
SHA1: c4e9978480fc51ce20e6201ddfd68fb6fbf50e8a SHA256: 3abb5ee62379091c6d863b85c86479f535bb423930f7bf394c232aa5c9927eea SSDeep: 49152:zDxL8QBonTex4S120ytJyYBz4Jm8/3gCK5ROA:zR89K1gBwm8/QCcROA |
|
|
| C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[back_me@foxmail.com].php | 10.25 MB |
MD5:
8155df203e443289142ae468f16d008b
SHA1: 00849e3e56fb221b6182ecae2adb2a864d5127cc SHA256: b8a854cc20be2cb52a3b3678ba7b7a244af26e20eaf520736275011b39d711df SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+A7p:MUvTiNhU4L7tZiTnprP0txRsA7p |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[back_me@foxmail.com].php | 14.88 MB |
MD5:
0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35 SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307 SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ |
|
|
| C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[back_me@foxmail.com].php | 3.48 MB |
MD5:
334521165f640d407e1beee71dd34595
SHA1: 0ac7540455967328df5ce20ff64edde89d48ad30 SHA256: 2ab6bf1c2038a99ab3775d2f3dd27b54feff04de34672a63bb69d369ec1ac6ec SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6XD5JN8mswRlcjt:fqLVW6vXnNhRlm |
|
|
| C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[back_me@foxmail.com].php | 2.35 MB |
MD5:
5ac3b2f823590cead6e0b6be5d7e60a0
SHA1: 2947961c5695a34af5c6d1ffb5e8daac2395e471 SHA256: 270fd42d0d7f4f7e56ec37f0d625e9493ebf2a7ef22166dbf84fc4746f15e5f8 SSDeep: 49152:R0opH/cgHa3HRxz+4gDTqeLGT1uhjMF9Uygt:R0op1Har+oeLiXgVt |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[back_me@foxmail.com].php | 42.53 MB |
MD5:
4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63 SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj |
|
|
| C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[back_me@foxmail.com].php | 3.16 MB |
MD5:
5e9f8d7188f17b96a1befd8cbe72ffc4
SHA1: 163447ac97d0490e78f705ab02f2f58d5483958f SHA256: 5ecf9762f13699281a970f0f6f34043105ee02eb58fd9c8750e211714a2e4912 SSDeep: 49152:zDxL8QBoSTex4S120ytJy2nTH7k5Fjp7T6lHdAa:zR89r1Mw9v2Ht |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | 11.70 MB |
MD5:
052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021 SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | 13.76 MB |
MD5:
42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163 SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455 SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ |
|
|
| C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | 20.84 MB |
MD5:
3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0 SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS |
|
|
| C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[back_me@foxmail.com].php | 3.54 MB |
MD5:
d0ade2e82969acb3dd0b87d087409f18
SHA1: 99ff4724126745d919c19a50b14e43483ff168e6 SHA256: 69ce3ff5b9b3f377d0c0cb19be8b0b659df02bceecb76986a2c774fca1baa61c SSDeep: 98304:zDMUwxyODPFhbY12HLodiF4+5risZukJQO9m+:z4UwVthio4UVQOn |
|
|
Host Behavior
File (4065)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Windows\System32\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
2 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BOOTSTAT.DAT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\BOOTSECT.BAK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DissolveNoise.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\archive.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\archive.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\medical lectures.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\medical lectures.exe | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Read | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | size = 1048560, size_out = 129 |
|
1 | |
| Read | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | size = 1048560, size_out = 645 |
|
1 | |
| Read | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini | size = 1048560, size_out = 0 |
|
1 | |
| Write | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 144 |
|
1 | |
| Write | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[back_me@foxmail.com].php | size = 15072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 1696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 1072 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[back_me@foxmail.com].php | size = 1952 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 786688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | size = 832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2304 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2640 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 242 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[back_me@foxmail.com].php | size = 596352 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1856 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 71248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 226 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 5568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 37696 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 26944 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 27200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | size = 832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1392 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 242 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2368 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 4288 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 67200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 3200 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 4208 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 246 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 6432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 16688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 9360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2000 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[back_me@foxmail.com].php | size = 816 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 31104 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | size = 5888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 16864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1888 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 20592 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 8736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 6256 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[back_me@foxmail.com].php | size = 8928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1856 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[back_me@foxmail.com].php | size = 39024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 1808 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[back_me@foxmail.com].php | size = 11472 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[back_me@foxmail.com].php | size = 8576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[back_me@foxmail.com].php | size = 227312 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 9504 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[back_me@foxmail.com].php | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 656 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[back_me@foxmail.com].php | size = 2688 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[back_me@foxmail.com].php | size = 134864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 25248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 19792 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG | size = 262144 |
|
2 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 2864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 33024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1936 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 34928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 31840 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 27408 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 20640 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 2736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 32608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2048 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 29936 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 43280 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 2192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1296 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 20576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1296 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 960 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 33280 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 28608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | size = 1376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 32416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 20384 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 26416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 32448 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | size = 25120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 18832 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | size = 5136 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2480 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 19488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
2 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1248 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 60736 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1664 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 44864 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 18416 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | size = 3600 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1376 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 11584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 48128 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1600 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | size = 37456 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 5184 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 33568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 21760 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | size = 1344 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF | size = 244 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1440 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 37120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1424 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 19568 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 15744 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 16752 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 31984 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1680 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 47968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3984 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 34176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 53120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 4112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1024 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 27184 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 262144 |
|
3 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3616 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2528 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 19536 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1744 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 33488 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 21824 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 29312 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2672 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 42464 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
2 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1584 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 18384 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 334432 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 44304 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 72032 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 58032 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 945008 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | size = 4992 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 123968 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 416928 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 30176 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[back_me@foxmail.com].php | size = 720 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[back_me@foxmail.com].php | size = 252 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[back_me@foxmail.com].php | size = 169648 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 176 |
|
1 | |
| Write | C:\Program Files\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 109728 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 34080 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 32160 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 39520 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 415024 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 30960 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 9040 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 7232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 14880 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 28976 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 18752 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 7696 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 11904 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 528 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 99152 |
|
1 | |
| Write | C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 64112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[back_me@foxmail.com].php | size = 2560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 29792 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 6688 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 8112 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[back_me@foxmail.com].php | size = 543312 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[back_me@foxmail.com].php | size = 576 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[back_me@foxmail.com].php | size = 254 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 5264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 2608 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 10608 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 15312 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 12704 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 12496 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3488 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 4960 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 5040 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 1152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 7584 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 6992 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 13264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 8592 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 4896 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 9264 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 5024 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3968 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3392 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 3136 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[back_me@foxmail.com].php | size = 994192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[back_me@foxmail.com].php | size = 176320 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[back_me@foxmail.com].php | size = 7664 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 31120 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 5328 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3040 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 4736 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
2 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 4400 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 5376 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 629680 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[back_me@foxmail.com].php | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[back_me@foxmail.com].php | size = 38784 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[back_me@foxmail.com].php | size = 264112 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[back_me@foxmail.com].php | size = 1048560 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[back_me@foxmail.com].php | size = 438192 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 321408 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[back_me@foxmail.com].php | size = 6816 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 323952 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 786690 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[back_me@foxmail.com].php | size = 262144 |
|
3 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 20592 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 7088 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 1600 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 7984 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 14432 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 26336 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 27872 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3760 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 5696 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3024 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2768 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 7376 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 712608 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10848 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 6640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 1840 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2112 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 9248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2352 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3424 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 6640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 4624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 5840 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 7552 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 6064 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 320400 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[back_me@foxmail.com].php | size = 1920 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[back_me@foxmail.com].php | size = 606064 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[back_me@foxmail.com].php | size = 1392 |
|
1 | |
| Write | C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Delete | C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | - |
|
1 | |
| Delete | C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | - |
|
1 | |
|
For performance reasons, the remaining 2834 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (8)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 83, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = MicosoftSearch.exe, data = C:\Windows\System32\MicosoftSearch.exe, size = 76, type = REG_SZ |
|
1 |
Process (1246)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\cmd.exe | os_pid = 0x968, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
1222 | |
| Enumerate Processes | - | - |
|
23 |
Module (186)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x76c20000 |
|
2 | |
| Load | KERNEL32.dll | base_address = 0x76c20000 |
|
1 | |
| Load | msvcr100.dll | base_address = 0x74ab0000 |
|
1 | |
| Load | advapi32.dll | base_address = 0x74d40000 |
|
1 | |
| Load | user32.dll | base_address = 0x74f40000 |
|
1 | |
| Load | Shell32.dll | base_address = 0x75fd0000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77130000 |
|
1 | |
| Load | mpr.dll | base_address = 0x74a90000 |
|
1 | |
| Load | ws2_32.dll | base_address = 0x75bc0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
28 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\micosoftsearch.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe, size = 260 |
|
1 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\micosoftsearch.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MicosoftSearch.exe, size = 32767 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x76c34f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x76c31252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x76c34208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x76c3359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EncodePointer, address_out = 0x77170fcb |
|
8 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DecodePointer, address_out = 0x77169d35 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GlobalAlloc, address_out = 0x76c3588e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualProtect, address_out = 0x76c3435f |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LoadLibraryA, address_out = 0x76c349d7 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualAlloc, address_out = 0x76c31856 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualFree, address_out = 0x76c3186e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersionExA, address_out = 0x76c33519 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = TerminateProcess, address_out = 0x76c4d802 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExitProcess, address_out = 0x76c37a10 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetErrorMode, address_out = 0x76c31b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcAddress, address_out = 0x76c31222 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForSingleObject, address_out = 0x76c31136 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LeaveCriticalSection, address_out = 0x77152270 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLastError, address_out = 0x76c311c0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EnterCriticalSection, address_out = 0x771522b0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReleaseMutex, address_out = 0x76c3111e |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CloseHandle, address_out = 0x76c31410 |
|
2 | |
| Get Address | c:\windows\syswow64\msvcr100.dll | function = atexit, address_out = 0x74acc544 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleHandleW, address_out = 0x76c334b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindNextFileW, address_out = 0x76c354ee |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindClose, address_out = 0x76c34442 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MoveFileW, address_out = 0x76c49af0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileSizeEx, address_out = 0x76c359e2 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x76c34950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileAttributesW, address_out = 0x76c31b18 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x76c35223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameW, address_out = 0x76c3dd0e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameA, address_out = 0x76c4b6e0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateMutexW, address_out = 0x76c3424c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenW, address_out = 0x76c31700 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenA, address_out = 0x76c35a4b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcess, address_out = 0x76c31809 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLogicalDrives, address_out = 0x76c35371 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetTickCount, address_out = 0x76c3110c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteFileW, address_out = 0x76c389b3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WideCharToMultiByte, address_out = 0x76c3170d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Sleep, address_out = 0x76c310ff |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReadFile, address_out = 0x76c33ed3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateFileW, address_out = 0x76c33f5c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenMutexW, address_out = 0x76c35151 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForMultipleObjects, address_out = 0x76c34220 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiW, address_out = 0x76c4d5cd |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiA, address_out = 0x76c33e8e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteCriticalSection, address_out = 0x771645f5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersion, address_out = 0x76c34467 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateThread, address_out = 0x76c334d5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExpandEnvironmentStringsW, address_out = 0x76c34173 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceCounter, address_out = 0x76c31725 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceFrequency, address_out = 0x76c341f0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcessId, address_out = 0x76c311f8 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFileAttributesW, address_out = 0x76c4d4f7 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVolumeInformationW, address_out = 0x76c4c860 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WriteFile, address_out = 0x76c31282 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFilePointerEx, address_out = 0x76c4c807 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetEndOfFile, address_out = 0x76c4ce2e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindFirstFileW, address_out = 0x76c34435 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcessHeap, address_out = 0x76c314e9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapReAlloc, address_out = 0x77171f6e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapAlloc, address_out = 0x7715e026 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapFree, address_out = 0x76c314c9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreatePipe, address_out = 0x76cb415b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetHandleInformation, address_out = 0x76c4195c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x76c3103d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringW, address_out = 0x76c33bca |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringA, address_out = 0x76c33c5a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenProcess, address_out = 0x76c31986 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetSystemTime, address_out = 0x76c35a96 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SystemTimeToFileTime, address_out = 0x76c35a7e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateToolhelp32Snapshot, address_out = 0x76c5735f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32NextW, address_out = 0x76c5896c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32FirstW, address_out = 0x76c58baf |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegOpenKeyExW, address_out = 0x74d5468d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegQueryValueExW, address_out = 0x74d546ad |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegSetValueExW, address_out = 0x74d514d6 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegCloseKey, address_out = 0x74d5469d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenProcessToken, address_out = 0x74d54304 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = GetTokenInformation, address_out = 0x74d5431c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenSCManagerW, address_out = 0x74d4ca64 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenServiceW, address_out = 0x74d4ca4c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CloseServiceHandle, address_out = 0x74d5369c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = ControlService, address_out = 0x74d67144 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = QueryServiceStatus, address_out = 0x74d52a86 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumDependentServicesW, address_out = 0x74d41e3a |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumServicesStatusExW, address_out = 0x74d4b466 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x74f590d3 |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExW, address_out = 0x75ff1e46 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQuerySystemInformation, address_out = 0x7714fda0 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetCloseEnum, address_out = 0x74a92dd6 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetOpenEnumW, address_out = 0x74a92f06 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetEnumResourceW, address_out = 0x74a93058 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = WSAStartup, address_out = 0x75bc3ab2 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = socket, address_out = 0x75bc3eb8 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = send, address_out = 0x75bc6f01 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = recv, address_out = 0x75bc6b0e |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = connect, address_out = 0x75bc6bdd |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = closesocket, address_out = 0x75bc3918 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = gethostbyname, address_out = 0x75bd7673 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = inet_addr, address_out = 0x75bc311b |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = ntohl, address_out = 0x75bc2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htonl, address_out = 0x75bc2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htons, address_out = 0x75bc2d8b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x76c4d650 |
|
16 |
Service (69)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 |
System (467)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = XDUWTFONO |
|
1 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
22 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 100 milliseconds (0.100 seconds) |
|
22 | |
| Get Time | type = System Time, time = 2019-07-07 23:39:38 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 100339 |
|
1 | |
| Get Time | type = Performance Ctr, time = 14938021749 |
|
1 | |
| Get Time | type = Ticks, time = 100480 |
|
28 | |
| Get Time | type = Ticks, time = 100495 |
|
221 | |
| Get Time | type = Performance Ctr, time = 15189083542 |
|
1 | |
| Get Time | type = Ticks, time = 100761 |
|
3 | |
| Get Time | type = Ticks, time = 101447 |
|
1 | |
| Get Time | type = Ticks, time = 101572 |
|
1 | |
| Get Time | type = Ticks, time = 101619 |
|
1 | |
| Get Time | type = Ticks, time = 101790 |
|
2 | |
| Get Time | type = Ticks, time = 102009 |
|
2 | |
| Get Time | type = Ticks, time = 102149 |
|
2 | |
| Get Time | type = Ticks, time = 102508 |
|
3 | |
| Get Time | type = Ticks, time = 102679 |
|
3 | |
| Get Time | type = Ticks, time = 103007 |
|
2 | |
| Get Time | type = Ticks, time = 103350 |
|
2 | |
| Get Time | type = Ticks, time = 103631 |
|
3 | |
| Get Time | type = Ticks, time = 104130 |
|
3 | |
| Get Time | type = Ticks, time = 104551 |
|
2 | |
| Get Time | type = Ticks, time = 104801 |
|
3 | |
| Get Time | type = Ticks, time = 105238 |
|
3 | |
| Get Time | type = Ticks, time = 105441 |
|
2 | |
| Get Time | type = Ticks, time = 105784 |
|
2 | |
| Get Time | type = Ticks, time = 106205 |
|
3 | |
| Get Time | type = Ticks, time = 106423 |
|
3 | |
| Get Time | type = Ticks, time = 106876 |
|
2 | |
| Get Time | type = Ticks, time = 107266 |
|
3 | |
| Get Time | type = Ticks, time = 107578 |
|
3 | |
| Get Time | type = Ticks, time = 107734 |
|
2 | |
| Get Time | type = Ticks, time = 107968 |
|
2 | |
| Get Time | type = Ticks, time = 108405 |
|
3 | |
| Get Time | type = Ticks, time = 108826 |
|
3 | |
| Get Time | type = Ticks, time = 109153 |
|
2 | |
| Get Time | type = Ticks, time = 109434 |
|
3 | |
| Get Time | type = Ticks, time = 109731 |
|
2 | |
| Get Time | type = Ticks, time = 110526 |
|
4 | |
| Get Time | type = Ticks, time = 110947 |
|
2 | |
| Get Time | type = Ticks, time = 111400 |
|
2 | |
| Get Time | type = Ticks, time = 111587 |
|
4 | |
| Get Time | type = Ticks, time = 112071 |
|
2 | |
| Get Time | type = Ticks, time = 112289 |
|
2 | |
| Get Time | type = Ticks, time = 112788 |
|
4 | |
| Get Time | type = Ticks, time = 113131 |
|
2 | |
| Get Time | type = Ticks, time = 113428 |
|
2 | |
| Get Time | type = Ticks, time = 113693 |
|
2 | |
| Get Time | type = Ticks, time = 114099 |
|
4 | |
| Get Time | type = Ticks, time = 114426 |
|
2 | |
| Get Time | type = Ticks, time = 114598 |
|
2 | |
| Get Time | type = Ticks, time = 114972 |
|
2 | |
| Get Time | type = Ticks, time = 115425 |
|
2 | |
| Get Time | type = Ticks, time = 115456 |
|
2 | |
| Get Time | type = Ticks, time = 115768 |
|
2 | |
| Get Time | type = Ticks, time = 116111 |
|
2 | |
| Get Time | type = Ticks, time = 116329 |
|
2 | |
| Get Time | type = Ticks, time = 117172 |
|
4 | |
| Get Time | type = Ticks, time = 117499 |
|
2 | |
| Get Time | type = Ticks, time = 117718 |
|
2 | |
| Get Time | type = Ticks, time = 117952 |
|
2 | |
| Get Time | type = Ticks, time = 118217 |
|
4 | |
| Get Time | type = Ticks, time = 119044 |
|
2 | |
| Get Time | type = Ticks, time = 119481 |
|
4 | |
| Get Time | type = Ticks, time = 119839 |
|
2 | |
| Get Time | type = Ticks, time = 120307 |
|
2 | |
| Get Time | type = Ticks, time = 120963 |
|
4 | |
| Get Time | type = Ticks, time = 121072 |
|
2 | |
| Get Time | type = Ticks, time = 121696 |
|
2 | |
| Get Time | type = Ticks, time = 122164 |
|
4 | |
| Get Time | type = Ticks, time = 122694 |
|
2 | |
| Get Time | type = Ticks, time = 122881 |
|
2 | |
| Get Time | type = Ticks, time = 123240 |
|
4 | |
| Get Time | type = Ticks, time = 123677 |
|
2 | |
| Get Time | type = Ticks, time = 123849 |
|
2 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\syncronize_ZD24L0A |
|
1 | |
| Create | mutex_name = Global\syncronize_ZD24L0U |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0A, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0U, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #2: cmd.exe
246
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\Windows\system32\cmd.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:31, Reason: Child Process |
| Unmonitor | End Time: 00:00:59, Reason: Self Terminated |
| Monitor Duration | 00:00:27 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x968 |
| Parent PID | 0x954 (c:\users\5p5nrgjn0js halpmcxz\desktop\micosoftsearch.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
96C
|
Host Behavior
File (182)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
5 | |
| Open | STD_OUTPUT_HANDLE | - |
|
25 | |
| Open | STD_INPUT_HANDLE | - |
|
69 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
60 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
4 | |
| Write | STD_OUTPUT_HANDLE | size = 63 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\mode.com | os_pid = 0x990, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Create | C:\Windows\system32\vssadmin.exe | os_pid = 0x9b0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\Windows\system32\mode.com | type = PROCESS_BASIC_INFORMATION |
|
1 | |
| Get Info | C:\Windows\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\Windows\system32\mode.com | address = 8796092850176, size = 896 |
|
1 | |
| Read | C:\Windows\system32\vssadmin.exe | address = 8796092846080, size = 896 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x76f50000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4a420000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x76fa14a0 |
|
1 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-07-07 23:39:39 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 101291 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15341354267 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Environment (25)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
8 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
3 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
3 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
2 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000000 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #3: mode.com
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\mode.com |
| Command Line | mode con cp select=1251 |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:33, Reason: Child Process |
| Unmonitor | End Time: 00:00:34, Reason: Self Terminated |
| Monitor Duration | 00:00:01 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x990 |
| Parent PID | 0x968 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
994
|
Process #4: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:33, Reason: Child Process |
| Unmonitor | End Time: 00:00:58, Reason: Self Terminated |
| Monitor Duration | 00:00:24 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9b0 |
| Parent PID | 0x968 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9B4
0x
9CC
0x
9D0
0x
9D4
0x
9D8
|
Process #5: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:38, Reason: RPC Server |
| Unmonitor | End Time: 00:01:06, Reason: Self Terminated |
| Monitor Duration | 00:00:28 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x9dc |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A8C
0x
A88
0x
9F8
0x
9F4
0x
9EC
0x
9E8
0x
9E4
0x
9E0
0x
A98
0x
BFC
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-07-07 23:39:44 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 106049 |
|
1 | |
| Get Time | type = Performance Ctr, time = 15933259806 |
|
1 |
Process #7: micosoftsearch.exe
420
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\micosoftsearch.exe |
| Command Line | "C:\Windows\System32\MicosoftSearch.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:03:53, Reason: Autostart |
| Unmonitor | End Time: 00:04:00, Reason: Self Terminated |
| Monitor Duration | 00:00:06 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x544 |
| Parent PID | 0x460 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
548
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (151)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x75a00000 |
|
2 | |
| Load | KERNEL32.dll | base_address = 0x75a00000 |
|
1 | |
| Load | msvcr100.dll | base_address = 0x73260000 |
|
1 | |
| Load | advapi32.dll | base_address = 0x74fd0000 |
|
1 | |
| Load | user32.dll | base_address = 0x75f80000 |
|
1 | |
| Load | Shell32.dll | base_address = 0x76260000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77410000 |
|
1 | |
| Load | mpr.dll | base_address = 0x73220000 |
|
1 | |
| Load | ws2_32.dll | base_address = 0x76fd0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75a00000 |
|
12 | |
| Get Filename | - | process_name = c:\windows\system32\micosoftsearch.exe, file_name_orig = C:\Windows\System32\MicosoftSearch.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75a14f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75a11252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75a14208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75a1359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EncodePointer, address_out = 0x77450fcb |
|
8 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DecodePointer, address_out = 0x77449d35 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GlobalAlloc, address_out = 0x75a1588e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualProtect, address_out = 0x75a1435f |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LoadLibraryA, address_out = 0x75a149d7 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualAlloc, address_out = 0x75a11856 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualFree, address_out = 0x75a1186e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersionExA, address_out = 0x75a13519 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = TerminateProcess, address_out = 0x75a2d802 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExitProcess, address_out = 0x75a17a10 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetErrorMode, address_out = 0x75a11b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcAddress, address_out = 0x75a11222 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForSingleObject, address_out = 0x75a11136 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = InitializeCriticalSectionAndSpinCount, address_out = 0x75a11916 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LeaveCriticalSection, address_out = 0x77432270 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLastError, address_out = 0x75a111c0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EnterCriticalSection, address_out = 0x774322b0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReleaseMutex, address_out = 0x75a1111e |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CloseHandle, address_out = 0x75a11410 |
|
2 | |
| Get Address | c:\windows\syswow64\msvcr100.dll | function = atexit, address_out = 0x7327c544 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleHandleW, address_out = 0x75a134b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindNextFileW, address_out = 0x75a154ee |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindClose, address_out = 0x75a14442 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MoveFileW, address_out = 0x75a29af0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileSizeEx, address_out = 0x75a159e2 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x75a14950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileAttributesW, address_out = 0x75a11b18 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x75a15223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameW, address_out = 0x75a1dd0e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameA, address_out = 0x75a2b6e0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateMutexW, address_out = 0x75a1424c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenW, address_out = 0x75a11700 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenA, address_out = 0x75a15a4b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcess, address_out = 0x75a11809 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLogicalDrives, address_out = 0x75a15371 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetTickCount, address_out = 0x75a1110c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteFileW, address_out = 0x75a189b3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WideCharToMultiByte, address_out = 0x75a1170d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Sleep, address_out = 0x75a110ff |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReadFile, address_out = 0x75a13ed3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateFileW, address_out = 0x75a13f5c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenMutexW, address_out = 0x75a15151 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForMultipleObjects, address_out = 0x75a14220 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiW, address_out = 0x75a2d5cd |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiA, address_out = 0x75a13e8e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteCriticalSection, address_out = 0x774445f5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersion, address_out = 0x75a14467 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateThread, address_out = 0x75a134d5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExpandEnvironmentStringsW, address_out = 0x75a14173 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceCounter, address_out = 0x75a11725 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceFrequency, address_out = 0x75a141f0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcessId, address_out = 0x75a111f8 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFileAttributesW, address_out = 0x75a2d4f7 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVolumeInformationW, address_out = 0x75a2c860 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WriteFile, address_out = 0x75a11282 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFilePointerEx, address_out = 0x75a2c807 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetEndOfFile, address_out = 0x75a2ce2e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindFirstFileW, address_out = 0x75a14435 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcessHeap, address_out = 0x75a114e9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapReAlloc, address_out = 0x77451f6e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapAlloc, address_out = 0x7743e026 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapFree, address_out = 0x75a114c9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreatePipe, address_out = 0x75a9415b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetHandleInformation, address_out = 0x75a2195c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x75a1103d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringW, address_out = 0x75a13bca |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringA, address_out = 0x75a13c5a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenProcess, address_out = 0x75a11986 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetSystemTime, address_out = 0x75a15a96 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SystemTimeToFileTime, address_out = 0x75a15a7e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateToolhelp32Snapshot, address_out = 0x75a3735f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32NextW, address_out = 0x75a3896c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32FirstW, address_out = 0x75a38baf |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegOpenKeyExW, address_out = 0x74fe468d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegQueryValueExW, address_out = 0x74fe46ad |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegSetValueExW, address_out = 0x74fe14d6 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegCloseKey, address_out = 0x74fe469d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenProcessToken, address_out = 0x74fe4304 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = GetTokenInformation, address_out = 0x74fe431c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenSCManagerW, address_out = 0x74fdca64 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenServiceW, address_out = 0x74fdca4c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CloseServiceHandle, address_out = 0x74fe369c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = ControlService, address_out = 0x74ff7144 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = QueryServiceStatus, address_out = 0x74fe2a86 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumDependentServicesW, address_out = 0x74fd1e3a |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumServicesStatusExW, address_out = 0x74fdb466 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x75f990d3 |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExW, address_out = 0x76281e46 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQuerySystemInformation, address_out = 0x7742fda0 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetCloseEnum, address_out = 0x73222dd6 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetOpenEnumW, address_out = 0x73222f06 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetEnumResourceW, address_out = 0x73223058 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = WSAStartup, address_out = 0x76fd3ab2 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = socket, address_out = 0x76fd3eb8 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = send, address_out = 0x76fd6f01 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = recv, address_out = 0x76fd6b0e |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = connect, address_out = 0x76fd6bdd |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = closesocket, address_out = 0x76fd3918 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = gethostbyname, address_out = 0x76fe7673 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = inet_addr, address_out = 0x76fd311b |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = ntohl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htonl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htons, address_out = 0x76fd2d8b |
|
1 |
System (259)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-07-07 23:43:08 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 26130 |
|
1 | |
| Get Time | type = Performance Ctr, time = 6963923041 |
|
1 | |
| Get Time | type = Ticks, time = 26379 |
|
249 | |
| Get Time | type = Performance Ctr, time = 7161089780 |
|
1 | |
| Get Time | type = Ticks, time = 28111 |
|
3 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (2)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Open | mutex_name = Global\syncronize_ZD24L0A, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0U, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #8: micosoftsearch.exe
420
0
| Information | Value |
|---|---|
| ID | #8 |
| File Name | c:\programdata\microsoft\windows\start menu\programs\startup\micosoftsearch.exe |
| Command Line | "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:03:53, Reason: Autostart |
| Unmonitor | End Time: 00:04:00, Reason: Self Terminated |
| Monitor Duration | 00:00:07 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x554 |
| Parent PID | 0x460 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
558
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (151)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x75a00000 |
|
2 | |
| Load | KERNEL32.dll | base_address = 0x75a00000 |
|
1 | |
| Load | msvcr100.dll | base_address = 0x73260000 |
|
1 | |
| Load | advapi32.dll | base_address = 0x74fd0000 |
|
1 | |
| Load | user32.dll | base_address = 0x75f80000 |
|
1 | |
| Load | Shell32.dll | base_address = 0x76260000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77410000 |
|
1 | |
| Load | mpr.dll | base_address = 0x73220000 |
|
1 | |
| Load | ws2_32.dll | base_address = 0x76fd0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75a00000 |
|
12 | |
| Get Filename | - | process_name = c:\programdata\microsoft\windows\start menu\programs\startup\micosoftsearch.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75a14f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75a11252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75a14208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75a1359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EncodePointer, address_out = 0x77450fcb |
|
8 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DecodePointer, address_out = 0x77449d35 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GlobalAlloc, address_out = 0x75a1588e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualProtect, address_out = 0x75a1435f |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LoadLibraryA, address_out = 0x75a149d7 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualAlloc, address_out = 0x75a11856 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualFree, address_out = 0x75a1186e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersionExA, address_out = 0x75a13519 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = TerminateProcess, address_out = 0x75a2d802 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExitProcess, address_out = 0x75a17a10 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetErrorMode, address_out = 0x75a11b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcAddress, address_out = 0x75a11222 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForSingleObject, address_out = 0x75a11136 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = InitializeCriticalSectionAndSpinCount, address_out = 0x75a11916 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LeaveCriticalSection, address_out = 0x77432270 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLastError, address_out = 0x75a111c0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EnterCriticalSection, address_out = 0x774322b0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReleaseMutex, address_out = 0x75a1111e |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CloseHandle, address_out = 0x75a11410 |
|
2 | |
| Get Address | c:\windows\syswow64\msvcr100.dll | function = atexit, address_out = 0x7327c544 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleHandleW, address_out = 0x75a134b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindNextFileW, address_out = 0x75a154ee |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindClose, address_out = 0x75a14442 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MoveFileW, address_out = 0x75a29af0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileSizeEx, address_out = 0x75a159e2 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x75a14950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileAttributesW, address_out = 0x75a11b18 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x75a15223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameW, address_out = 0x75a1dd0e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameA, address_out = 0x75a2b6e0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateMutexW, address_out = 0x75a1424c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenW, address_out = 0x75a11700 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenA, address_out = 0x75a15a4b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcess, address_out = 0x75a11809 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLogicalDrives, address_out = 0x75a15371 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetTickCount, address_out = 0x75a1110c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteFileW, address_out = 0x75a189b3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WideCharToMultiByte, address_out = 0x75a1170d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Sleep, address_out = 0x75a110ff |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReadFile, address_out = 0x75a13ed3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateFileW, address_out = 0x75a13f5c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenMutexW, address_out = 0x75a15151 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForMultipleObjects, address_out = 0x75a14220 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiW, address_out = 0x75a2d5cd |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiA, address_out = 0x75a13e8e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteCriticalSection, address_out = 0x774445f5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersion, address_out = 0x75a14467 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateThread, address_out = 0x75a134d5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExpandEnvironmentStringsW, address_out = 0x75a14173 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceCounter, address_out = 0x75a11725 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceFrequency, address_out = 0x75a141f0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcessId, address_out = 0x75a111f8 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFileAttributesW, address_out = 0x75a2d4f7 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVolumeInformationW, address_out = 0x75a2c860 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WriteFile, address_out = 0x75a11282 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFilePointerEx, address_out = 0x75a2c807 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetEndOfFile, address_out = 0x75a2ce2e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindFirstFileW, address_out = 0x75a14435 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcessHeap, address_out = 0x75a114e9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapReAlloc, address_out = 0x77451f6e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapAlloc, address_out = 0x7743e026 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapFree, address_out = 0x75a114c9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreatePipe, address_out = 0x75a9415b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetHandleInformation, address_out = 0x75a2195c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x75a1103d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringW, address_out = 0x75a13bca |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringA, address_out = 0x75a13c5a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenProcess, address_out = 0x75a11986 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetSystemTime, address_out = 0x75a15a96 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SystemTimeToFileTime, address_out = 0x75a15a7e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateToolhelp32Snapshot, address_out = 0x75a3735f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32NextW, address_out = 0x75a3896c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32FirstW, address_out = 0x75a38baf |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegOpenKeyExW, address_out = 0x74fe468d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegQueryValueExW, address_out = 0x74fe46ad |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegSetValueExW, address_out = 0x74fe14d6 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegCloseKey, address_out = 0x74fe469d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenProcessToken, address_out = 0x74fe4304 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = GetTokenInformation, address_out = 0x74fe431c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenSCManagerW, address_out = 0x74fdca64 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenServiceW, address_out = 0x74fdca4c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CloseServiceHandle, address_out = 0x74fe369c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = ControlService, address_out = 0x74ff7144 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = QueryServiceStatus, address_out = 0x74fe2a86 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumDependentServicesW, address_out = 0x74fd1e3a |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumServicesStatusExW, address_out = 0x74fdb466 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x75f990d3 |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExW, address_out = 0x76281e46 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQuerySystemInformation, address_out = 0x7742fda0 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetCloseEnum, address_out = 0x73222dd6 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetOpenEnumW, address_out = 0x73222f06 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetEnumResourceW, address_out = 0x73223058 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = WSAStartup, address_out = 0x76fd3ab2 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = socket, address_out = 0x76fd3eb8 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = send, address_out = 0x76fd6f01 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = recv, address_out = 0x76fd6b0e |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = connect, address_out = 0x76fd6bdd |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = closesocket, address_out = 0x76fd3918 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = gethostbyname, address_out = 0x76fe7673 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = inet_addr, address_out = 0x76fd311b |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = ntohl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htonl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htons, address_out = 0x76fd2d8b |
|
1 |
System (259)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-07-07 23:43:08 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 26114 |
|
1 | |
| Get Time | type = Performance Ctr, time = 6961944465 |
|
1 | |
| Get Time | type = Ticks, time = 26332 |
|
249 | |
| Get Time | type = Performance Ctr, time = 7162613409 |
|
1 | |
| Get Time | type = Ticks, time = 28126 |
|
3 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (2)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Open | mutex_name = Global\syncronize_ZD24L0A, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0U, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #9: micosoftsearch.exe
13258
0
| Information | Value |
|---|---|
| ID | #9 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\micosoftsearch.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:03:53, Reason: Autostart |
| Unmonitor | End Time: 00:04:37, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:43 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x55c |
| Parent PID | 0x460 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
560
0x
5C0
0x
5D0
0x
5D4
0x
5D8
0x
5DC
0x
5E0
0x
600
0x
624
0x
628
0x
62C
0x
630
0x
634
0x
638
0x
63C
0x
640
0x
64C
0x
650
0x
654
0x
65C
|
Host Behavior
File (1476)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
2 | |
| Create | C:\Windows\System32\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ |
|
2 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootex.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootsqm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootsqm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootsqm.dat.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootex.log | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\bootex.log.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DL_RES.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DL_RES.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.id-9C354B42.[back_me@foxmail.com].php | desired_access = GENERIC_WRITE |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Create Pipe | Anonymous read pipe | size = 0 |
|
1 | |
| Get Info | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | type = size, size_out = 129 |
|
1 | |
| Get Info | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\da-DK\bootmgr.exe.mui | type = size, size_out = 87616 |
|
1 | |
| Get Info | C:\Boot\da-DK\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\da-DK\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\de-DE\bootmgr.exe.mui | type = size, size_out = 91712 |
|
1 | |
| Get Info | C:\Boot\de-DE\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\de-DE\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\el-GR\bootmgr.exe.mui | type = size, size_out = 94800 |
|
1 | |
| Get Info | C:\Boot\el-GR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\el-GR\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\en-US\bootmgr.exe.mui | type = size, size_out = 85056 |
|
1 | |
| Get Info | C:\Boot\en-US\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\en-US\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\en-US\memtest.exe.mui | type = size, size_out = 43600 |
|
1 | |
| Get Info | C:\Boot\en-US\memtest.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\en-US\memtest.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\es-ES\bootmgr.exe.mui | type = size, size_out = 90192 |
|
1 | |
| Get Info | C:\Boot\es-ES\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\es-ES\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\es-ES\bootmgr.exe.mui | type = size, size_out = 0 |
|
1 | |
| Get Info | C:\Boot\es-ES\bootmgr.exe.mui | type = size, size_out = 3264 |
|
1 | |
| Get Info | C:\bootsqm.dat | type = file_attributes |
|
1 | |
| Get Info | C:\bootsqm.dat.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\cs-CZ\bootmgr.exe.mui | type = size, size_out = 0 |
|
1 | |
| Get Info | C:\Boot\cs-CZ\bootmgr.exe.mui | type = size, size_out = 89168 |
|
1 | |
| Get Info | C:\Boot\cs-CZ\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\cs-CZ\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\Fonts\wgl4_boot.ttf | type = size, size_out = 2371360 |
|
1 | |
| Get Info | C:\Boot\Fonts\kor_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\Fonts\kor_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\fr-FR\bootmgr.exe.mui | type = size, size_out = 93248 |
|
1 | |
| Get Info | C:\Boot\fr-FR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\fr-FR\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\hu-HU\bootmgr.exe.mui | type = size, size_out = 90688 |
|
1 | |
| Get Info | C:\Boot\hu-HU\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\hu-HU\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\it-IT\bootmgr.exe.mui | type = size, size_out = 90704 |
|
1 | |
| Get Info | C:\Boot\it-IT\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\it-IT\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\ja-JP\bootmgr.exe.mui | type = size, size_out = 76352 |
|
1 | |
| Get Info | C:\Boot\ja-JP\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\ja-JP\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\ko-KR\bootmgr.exe.mui | type = size, size_out = 75344 |
|
1 | |
| Get Info | C:\Boot\ko-KR\bootmgr.exe.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\ko-KR\bootmgr.exe.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\ko-KR\bootmgr.exe.mui | type = size, size_out = 47452 |
|
1 | |
| Get Info | C:\Boot\Fonts\wgl4_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\Fonts\wgl4_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | type = size, size_out = 3584 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | type = size, size_out = 3584 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | type = size, size_out = 1984228 |
|
1 | |
| Get Info | C:\Boot\Fonts\jpn_boot.ttf | type = file_attributes |
|
1 | |
| Get Info | C:\Boot\Fonts\jpn_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | type = size, size_out = 4096 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\bootex.log | type = size, size_out = 5120 |
|
1 | |
| Get Info | C:\bootex.log | type = file_attributes |
|
1 | |
| Get Info | C:\bootex.log.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | type = size, size_out = 791686 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | type = size, size_out = 27045 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | type = size, size_out = 89600 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | type = size, size_out = 33280 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | type = size, size_out = 40448 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | type = size, size_out = 3584 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | type = size, size_out = 110592 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | type = size, size_out = 544768 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | type = size, size_out = 12288 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | type = size, size_out = 448000 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | type = size, size_out = 62976 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | type = size, size_out = 197120 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | type = size, size_out = 224256 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | type = size, size_out = 222208 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | type = size, size_out = 194048 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | type = size, size_out = 1600388 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | type = size, size_out = 1434 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | type = size, size_out = 617 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | type = size, size_out = 15097 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | type = size, size_out = 9803 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | type = size, size_out = 11067 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | type = size, size_out = 10947 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | type = size, size_out = 38485 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL | type = size, size_out = 31744 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL | type = size, size_out = 4289376 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | type = size, size_out = 471 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | type = size, size_out = 219 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml | type = size, size_out = 215 |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | type = size, size_out = 9975 |
|
1 | |
| Get Info | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png | type = size, size_out = 5088 |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png | type = size, size_out = 2962 |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png | type = size, size_out = 30138 |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp | type = size, size_out = 5072 |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png | type = size, size_out = 4728 |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | type = size, size_out = 6165 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | type = size, size_out = 10562 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | type = size, size_out = 12981 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | type = size, size_out = 5983 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | type = size, size_out = 14044 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | type = size, size_out = 8501 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | type = size, size_out = 13358 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | type = size, size_out = 32818 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | type = size, size_out = 22417 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx | type = size, size_out = 1967905 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | type = size, size_out = 314017 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | type = size, size_out = 24611 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | type = size, size_out = 21423 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | type = size, size_out = 41295 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | type = size, size_out = 112504 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | type = size, size_out = 312400 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | - | type = size, size_out = 15776 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML.id-9C354B42.[back_me@foxmail.com].php | type = size, size_out = 15264 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL | type = size, size_out = 21424 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | type = size, size_out = 495616 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | type = size, size_out = 53144 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | type = size, size_out = 164216 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DL_RES.DLL | type = size, size_out = 10632 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DL_RES.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DL_RES.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | type = size, size_out = 1723 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | type = size, size_out = 64872 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | type = size, size_out = 1699 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS | type = size, size_out = 2278416 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT | type = size, size_out = 218 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK | type = size, size_out = 111 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK | type = size, size_out = 110 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL | type = size, size_out = 36200 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT | type = size, size_out = 214 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK | type = size, size_out = 114 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK | type = size, size_out = 113 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC | type = size, size_out = 636 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT | type = size, size_out = 208 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK | type = size, size_out = 114 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK | type = size, size_out = 113 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL | type = size, size_out = 1124720 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL | type = size, size_out = 108416 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL | type = size, size_out = 446312 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL | type = size, size_out = 39808 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD | type = size, size_out = 1420 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC | type = size, size_out = 621 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT | type = size, size_out = 205 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK | type = size, size_out = 114 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK | type = size, size_out = 113 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS | type = size, size_out = 4750792 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC | type = size, size_out = 641 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT | type = size, size_out = 205 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC | type = size, size_out = 626 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD | type = size, size_out = 2150 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC | type = size, size_out = 611 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT | type = size, size_out = 203 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK | type = size, size_out = 114 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK | type = size, size_out = 113 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL | type = size, size_out = 401792 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | type = size, size_out = 32184 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP | type = size, size_out = 31968 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP | type = size, size_out = 32184 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP | type = size, size_out = 32616 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF | type = size, size_out = 23596 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF | type = size, size_out = 11228 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF | type = size, size_out = 19328 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF | type = size, size_out = 7992 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF | type = size, size_out = 10508 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF | type = size, size_out = 2900 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF | type = size, size_out = 11584 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF | type = size, size_out = 10060 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF | type = size, size_out = 19600 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF | type = size, size_out = 2148 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF | type = size, size_out = 3332 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF | type = size, size_out = 13784 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF | type = size, size_out = 5272 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF | type = size, size_out = 15888 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF | type = size, size_out = 10852 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF | type = size, size_out = 12204 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF | type = size, size_out = 3644 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF | type = size, size_out = 5004 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF | type = size, size_out = 4788 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG | type = size, size_out = 17867 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG | type = size, size_out = 36792 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG | type = size, size_out = 33958 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG | type = size, size_out = 39542 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | type = size, size_out = 46508 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF | type = size, size_out = 13204 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF | type = size, size_out = 13336 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF | type = size, size_out = 10752 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF | type = size, size_out = 24844 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF | type = size, size_out = 11340 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF | type = size, size_out = 16052 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF | type = size, size_out = 3368 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF | type = size, size_out = 12436 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF | type = size, size_out = 5960 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF | type = size, size_out = 34676 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF | type = size, size_out = 1348 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | type = size, size_out = 4580 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF | type = size, size_out = 14888 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF | type = size, size_out = 9072 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF | type = size, size_out = 10668 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF | type = size, size_out = 11348 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF | type = size, size_out = 4496 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF | type = size, size_out = 33068 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF | type = size, size_out = 7432 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF | type = size, size_out = 12528 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF | type = size, size_out = 1376 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF | type = size, size_out = 46702 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF | type = size, size_out = 18652 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF | type = size, size_out = 29406 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG | type = size, size_out = 55554 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG | type = size, size_out = 36989 |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG | type = file_attributes |
|
1 | |
| Get Info | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.id-9C354B42.[back_me@foxmail.com].php | type = file_attributes |
|
1 | |
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 | |
| Move | C:\Boot\Fonts\chs_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Boot\Fonts\chs_boot.ttf |
|
1 | |
| Move | C:\Boot\Fonts\kor_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Boot\Fonts\kor_boot.ttf |
|
1 | |
| Move | C:\Boot\Fonts\jpn_boot.ttf.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Boot\Fonts\jpn_boot.ttf |
|
1 | |
| Move | C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi |
|
1 | |
| Move | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL |
|
1 | |
| Move | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx |
|
1 | |
| Move | C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS |
|
1 | |
| Move | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS.id-9C354B42.[back_me@foxmail.com].php | source_filename = C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | size = 1048576, size_out = 386048 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | size = 1048576, size_out = 0 |
|
1 | |
| Read | C:\bootsqm.dat | size = 1048560, size_out = 3264 |
|
1 | |
| Read | C:\Boot\Fonts\wgl4_boot.ttf | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\bootex.log | size = 1048560, size_out = 5120 |
|
1 | |
| Read | C:\bootex.log | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\bootex.log.id-9C354B42.[back_me@foxmail.com].php | size = 1048560, size_out = 666456 |
|
1 | |
| Read | C:\bootex.log.id-9C354B42.[back_me@foxmail.com].php | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | size = 1048560, size_out = 6165 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | size = 1048560, size_out = 10562 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | size = 1048560, size_out = 12981 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | size = 1048560, size_out = 5983 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | size = 1048560, size_out = 14044 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | size = 1048560, size_out = 8501 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | size = 1048560, size_out = 13358 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | size = 1048560, size_out = 32818 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | size = 1048560, size_out = 22417 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | size = 1048560, size_out = 314017 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | size = 1048560, size_out = 24611 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | size = 1048560, size_out = 21423 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | size = 1048560, size_out = 41295 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | size = 1048560, size_out = 112504 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | size = 1048560, size_out = 312400 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | size = 1048560, size_out = 495616 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | size = 1048560, size_out = 53144 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | size = 1048560, size_out = 164216 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | size = 1048560, size_out = 1723 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | size = 1048560, size_out = 64872 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | size = 1048560, size_out = 1699 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD | size = 1048560, size_out = 0 |
|
1 | |
| Read | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT | size = 1048560, size_out = 218 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.id-9C354B42.[back_me@foxmail.com].php | size = 666464 |
|
1 | |
| Write | C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 6176 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 10576 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 12992 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 5984 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 14048 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 8512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 13360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 32832 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 22432 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 314032 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 24624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 21424 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 41296 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 112512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML.id-9C354B42.[back_me@foxmail.com].php | size = 312416 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC.id-9C354B42.[back_me@foxmail.com].php | size = 495632 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 53152 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DBENGR.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 164224 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DBWIZ.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 230 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 1728 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DOORSCHD.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 64880 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\DRILLDWN.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 1712 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\EQPLIST.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 112 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 112 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 36208 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\HVAC.VSL.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 256 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 260 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 260 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 224 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 244 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 248 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | size = 108432 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | size = 246 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | size = 39824 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL.id-9C354B42.[back_me@foxmail.com].php | size = 252 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 1424 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MOVE.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 228 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 208 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 242 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 242 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 656 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 246 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 208 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 640 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 240 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 2160 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\NETWORK2.VRD.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 208 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT.id-9C354B42.[back_me@foxmail.com].php | size = 234 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 128 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK.id-9C354B42.[back_me@foxmail.com].php | size = 238 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 32192 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 31984 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 32192 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 32624 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 23600 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 11232 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 19344 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 8000 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2912 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 11600 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10064 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 19616 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 2160 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3344 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 13792 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 5280 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 15904 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10864 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 12208 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3648 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 5008 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 4800 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 17872 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 36800 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 33968 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 39552 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 46512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 13216 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 13344 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10768 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 24848 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 11344 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 16064 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 3376 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 12448 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 5968 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 34688 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 1360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 4592 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 14896 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 9088 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 10672 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 11360 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 4512 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 33072 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 7440 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 12544 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 1392 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 46704 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 18656 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 29408 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 55568 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 36992 |
|
1 | |
| Write | C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.id-9C354B42.[back_me@foxmail.com].php | size = 236 |
|
1 | |
|
For performance reasons, the remaining 474 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (10)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 83, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = MicosoftSearch.exe, data = 12090016, size = 128, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = MicosoftSearch.exe, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\MicosoftSearch.exe, size = 128, type = REG_SZ |
|
1 |
Process (1178)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\cmd.exe | os_pid = 0x5c4, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe | show_window = SW_SHOWNORMAL |
|
1 | |
| Enumerate Processes | - | - |
|
1134 | |
| Enumerate Processes | - | - |
|
42 |
Module (193)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x75a00000 |
|
2 | |
| Load | KERNEL32.dll | base_address = 0x75a00000 |
|
1 | |
| Load | msvcr100.dll | base_address = 0x73260000 |
|
1 | |
| Load | advapi32.dll | base_address = 0x74fd0000 |
|
1 | |
| Load | user32.dll | base_address = 0x75f80000 |
|
1 | |
| Load | Shell32.dll | base_address = 0x76260000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77410000 |
|
1 | |
| Load | mpr.dll | base_address = 0x73220000 |
|
1 | |
| Load | ws2_32.dll | base_address = 0x76fd0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75a00000 |
|
31 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\micosoftsearch.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe, size = 260 |
|
1 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\micosoftsearch.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicosoftSearch.exe, size = 32767 |
|
4 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75a14f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75a11252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75a14208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75a1359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EncodePointer, address_out = 0x77450fcb |
|
8 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DecodePointer, address_out = 0x77449d35 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GlobalAlloc, address_out = 0x75a1588e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualProtect, address_out = 0x75a1435f |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LoadLibraryA, address_out = 0x75a149d7 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualAlloc, address_out = 0x75a11856 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = VirtualFree, address_out = 0x75a1186e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersionExA, address_out = 0x75a13519 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = TerminateProcess, address_out = 0x75a2d802 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExitProcess, address_out = 0x75a17a10 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetErrorMode, address_out = 0x75a11b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcAddress, address_out = 0x75a11222 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForSingleObject, address_out = 0x75a11136 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = InitializeCriticalSectionAndSpinCount, address_out = 0x75a11916 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = LeaveCriticalSection, address_out = 0x77432270 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLastError, address_out = 0x75a111c0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = EnterCriticalSection, address_out = 0x774322b0 |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReleaseMutex, address_out = 0x75a1111e |
|
2 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CloseHandle, address_out = 0x75a11410 |
|
2 | |
| Get Address | c:\windows\syswow64\msvcr100.dll | function = atexit, address_out = 0x7327c544 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleHandleW, address_out = 0x75a134b0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindNextFileW, address_out = 0x75a154ee |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindClose, address_out = 0x75a14442 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MoveFileW, address_out = 0x75a29af0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileSizeEx, address_out = 0x75a159e2 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x75a14950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetFileAttributesW, address_out = 0x75a11b18 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x75a15223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameW, address_out = 0x75a1dd0e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetComputerNameA, address_out = 0x75a2b6e0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateMutexW, address_out = 0x75a1424c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenW, address_out = 0x75a11700 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrlenA, address_out = 0x75a15a4b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcess, address_out = 0x75a11809 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetLogicalDrives, address_out = 0x75a15371 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetTickCount, address_out = 0x75a1110c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteFileW, address_out = 0x75a189b3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WideCharToMultiByte, address_out = 0x75a1170d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Sleep, address_out = 0x75a110ff |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ReadFile, address_out = 0x75a13ed3 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateFileW, address_out = 0x75a13f5c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenMutexW, address_out = 0x75a15151 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WaitForMultipleObjects, address_out = 0x75a14220 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiW, address_out = 0x75a2d5cd |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = lstrcmpiA, address_out = 0x75a13e8e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = DeleteCriticalSection, address_out = 0x774445f5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVersion, address_out = 0x75a14467 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateThread, address_out = 0x75a134d5 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = ExpandEnvironmentStringsW, address_out = 0x75a14173 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceCounter, address_out = 0x75a11725 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = QueryPerformanceFrequency, address_out = 0x75a141f0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCurrentProcessId, address_out = 0x75a111f8 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFileAttributesW, address_out = 0x75a2d4f7 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetVolumeInformationW, address_out = 0x75a2c860 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = WriteFile, address_out = 0x75a11282 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetFilePointerEx, address_out = 0x75a2c807 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetEndOfFile, address_out = 0x75a2ce2e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindFirstFileW, address_out = 0x75a14435 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetProcessHeap, address_out = 0x75a114e9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapReAlloc, address_out = 0x77451f6e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapAlloc, address_out = 0x7743e026 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = HeapFree, address_out = 0x75a114c9 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreatePipe, address_out = 0x75a9415b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetHandleInformation, address_out = 0x75a2195c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x75a1103d |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringW, address_out = 0x75a13bca |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CompareStringA, address_out = 0x75a13c5a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = OpenProcess, address_out = 0x75a11986 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetSystemTime, address_out = 0x75a15a96 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SystemTimeToFileTime, address_out = 0x75a15a7e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateToolhelp32Snapshot, address_out = 0x75a3735f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32NextW, address_out = 0x75a3896c |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Process32FirstW, address_out = 0x75a38baf |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegOpenKeyExW, address_out = 0x74fe468d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegQueryValueExW, address_out = 0x74fe46ad |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegSetValueExW, address_out = 0x74fe14d6 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = RegCloseKey, address_out = 0x74fe469d |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenProcessToken, address_out = 0x74fe4304 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = GetTokenInformation, address_out = 0x74fe431c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenSCManagerW, address_out = 0x74fdca64 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = OpenServiceW, address_out = 0x74fdca4c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CloseServiceHandle, address_out = 0x74fe369c |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = ControlService, address_out = 0x74ff7144 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = QueryServiceStatus, address_out = 0x74fe2a86 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumDependentServicesW, address_out = 0x74fd1e3a |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = EnumServicesStatusExW, address_out = 0x74fdb466 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x75f990d3 |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExW, address_out = 0x76281e46 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQuerySystemInformation, address_out = 0x7742fda0 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetCloseEnum, address_out = 0x73222dd6 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetOpenEnumW, address_out = 0x73222f06 |
|
1 | |
| Get Address | c:\windows\syswow64\mpr.dll | function = WNetEnumResourceW, address_out = 0x73223058 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = WSAStartup, address_out = 0x76fd3ab2 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = socket, address_out = 0x76fd3eb8 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = send, address_out = 0x76fd6f01 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = recv, address_out = 0x76fd6b0e |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = connect, address_out = 0x76fd6bdd |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = closesocket, address_out = 0x76fd3918 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = gethostbyname, address_out = 0x76fe7673 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = inet_addr, address_out = 0x76fd311b |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = ntohl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htonl, address_out = 0x76fd2d57 |
|
1 | |
| Get Address | c:\windows\syswow64\ws2_32.dll | function = htons, address_out = 0x76fd2d8b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75a2d650 |
|
19 |
Service (127)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
6 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
6 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
9 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
9 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Enumerate | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
6 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
9 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
4 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
2 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
3 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 | |
| Open Manager | database_name = SERVICES_ACTIVE_DATABASE |
|
1 |
System (764)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = XDUWTFONO |
|
1 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
41 | |
| Sleep | duration = 100 milliseconds (0.100 seconds) |
|
170 | |
| Get Time | type = System Time, time = 2019-07-07 23:43:06 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 24367 |
|
1 | |
| Get Time | type = Performance Ctr, time = 6784897840 |
|
1 | |
| Get Time | type = Ticks, time = 26239 |
|
249 | |
| Get Time | type = Performance Ctr, time = 7158641846 |
|
1 | |
| Get Time | type = Ticks, time = 28080 |
|
3 | |
| Get Time | type = Ticks, time = 29265 |
|
2 | |
| Get Time | type = Ticks, time = 29499 |
|
2 | |
| Get Time | type = Ticks, time = 29718 |
|
2 | |
| Get Time | type = Ticks, time = 30014 |
|
2 | |
| Get Time | type = Ticks, time = 30248 |
|
2 | |
| Get Time | type = Ticks, time = 30482 |
|
4 | |
| Get Time | type = Ticks, time = 30638 |
|
2 | |
| Get Time | type = Ticks, time = 30966 |
|
2 | |
| Get Time | type = Ticks, time = 31247 |
|
2 | |
| Get Time | type = Ticks, time = 31356 |
|
2 | |
| Get Time | type = Ticks, time = 31933 |
|
4 | |
| Get Time | type = Ticks, time = 32526 |
|
2 | |
| Get Time | type = Ticks, time = 32978 |
|
4 | |
| Get Time | type = Ticks, time = 33259 |
|
2 | |
| Get Time | type = Ticks, time = 33368 |
|
2 | |
| Get Time | type = Ticks, time = 33618 |
|
2 | |
| Get Time | type = Ticks, time = 33961 |
|
2 | |
| Get Time | type = Ticks, time = 34257 |
|
4 | |
| Get Time | type = Ticks, time = 34398 |
|
2 | |
| Get Time | type = Ticks, time = 34554 |
|
2 | |
| Get Time | type = Ticks, time = 34757 |
|
2 | |
| Get Time | type = Ticks, time = 34881 |
|
2 | |
| Get Time | type = Ticks, time = 35022 |
|
2 | |
| Get Time | type = Ticks, time = 35147 |
|
2 | |
| Get Time | type = Ticks, time = 35271 |
|
4 | |
| Get Time | type = Ticks, time = 35490 |
|
2 | |
| Get Time | type = Ticks, time = 36254 |
|
2 | |
| Get Time | type = Ticks, time = 36379 |
|
4 | |
| Get Time | type = Ticks, time = 36675 |
|
2 | |
| Get Time | type = Ticks, time = 36972 |
|
2 | |
| Get Time | type = Ticks, time = 37159 |
|
2 | |
| Get Time | type = Ticks, time = 37377 |
|
2 | |
| Get Time | type = Ticks, time = 37565 |
|
4 | |
| Get Time | type = Ticks, time = 37845 |
|
2 | |
| Get Time | type = Ticks, time = 38033 |
|
2 | |
| Get Time | type = Ticks, time = 38625 |
|
4 | |
| Get Time | type = Ticks, time = 38735 |
|
2 | |
| Get Time | type = Ticks, time = 38891 |
|
2 | |
| Get Time | type = Ticks, time = 39031 |
|
2 | |
| Get Time | type = Ticks, time = 39156 |
|
2 | |
| Get Time | type = Ticks, time = 39343 |
|
2 | |
| Get Time | type = Ticks, time = 39452 |
|
2 | |
| Get Time | type = Ticks, time = 39671 |
|
4 | |
| Get Time | type = Ticks, time = 39858 |
|
2 | |
| Get Time | type = Ticks, time = 40295 |
|
2 | |
| Get Time | type = Ticks, time = 40607 |
|
2 | |
| Get Time | type = Ticks, time = 40716 |
|
4 | |
| Get Time | type = Ticks, time = 40903 |
|
2 | |
| Get Time | type = Ticks, time = 41153 |
|
2 | |
| Get Time | type = Ticks, time = 41402 |
|
2 | |
| Get Time | type = Ticks, time = 41839 |
|
4 | |
| Get Time | type = Ticks, time = 42245 |
|
2 | |
| Get Time | type = Ticks, time = 43165 |
|
4 | |
| Get Time | type = Ticks, time = 43368 |
|
2 | |
| Get Time | type = Ticks, time = 43851 |
|
2 | |
| Get Time | type = Ticks, time = 44101 |
|
2 | |
| Get Time | type = Ticks, time = 44663 |
|
4 | |
| Get Time | type = Ticks, time = 44787 |
|
2 | |
| Get Time | type = Ticks, time = 45006 |
|
2 | |
| Get Time | type = Ticks, time = 45224 |
|
2 | |
| Get Time | type = Ticks, time = 45661 |
|
2 | |
| Get Time | type = Ticks, time = 45957 |
|
4 | |
| Get Time | type = Ticks, time = 46675 |
|
2 | |
| Get Time | type = Ticks, time = 46925 |
|
2 | |
| Get Time | type = Ticks, time = 47252 |
|
4 | |
| Get Time | type = Ticks, time = 47408 |
|
2 | |
| Get Time | type = Ticks, time = 47705 |
|
2 | |
| Get Time | type = Ticks, time = 48095 |
|
2 | |
| Get Time | type = Ticks, time = 48422 |
|
4 | |
| Get Time | type = Ticks, time = 49483 |
|
4 | |
| Get Time | type = Ticks, time = 49733 |
|
2 | |
| Get Time | type = Ticks, time = 49951 |
|
2 | |
| Get Time | type = Ticks, time = 50684 |
|
4 | |
| Get Time | type = Ticks, time = 51090 |
|
2 | |
| Get Time | type = Ticks, time = 51371 |
|
2 | |
| Get Time | type = Ticks, time = 51683 |
|
2 | |
| Get Time | type = Ticks, time = 52010 |
|
4 | |
| Get Time | type = Ticks, time = 52603 |
|
2 | |
| Get Time | type = Ticks, time = 52899 |
|
2 | |
| Get Time | type = Ticks, time = 53055 |
|
4 | |
| Get Time | type = Ticks, time = 53211 |
|
2 | |
| Get Time | type = Ticks, time = 53367 |
|
2 | |
| Get Time | type = Ticks, time = 53508 |
|
2 | |
| Get Time | type = Ticks, time = 53789 |
|
2 | |
| Get Time | type = Ticks, time = 53991 |
|
2 | |
| Get Time | type = Ticks, time = 54725 |
|
4 | |
| Get Time | type = Ticks, time = 54959 |
|
2 | |
| Get Time | type = Ticks, time = 55115 |
|
2 | |
| Get Time | type = Ticks, time = 55255 |
|
2 | |
| Get Time | type = Ticks, time = 55380 |
|
2 | |
| Get Time | type = Ticks, time = 55661 |
|
2 | |
| Get Time | type = Ticks, time = 55817 |
|
4 | |
| Get Time | type = Ticks, time = 55973 |
|
2 | |
| Get Time | type = Ticks, time = 56378 |
|
2 | |
| Get Time | type = Ticks, time = 56675 |
|
2 | |
| Get Time | type = Ticks, time = 56690 |
|
2 | |
| Get Time | type = Ticks, time = 56893 |
|
4 | |
| Get Time | type = Ticks, time = 57158 |
|
2 | |
| Get Time | type = Ticks, time = 57314 |
|
2 | |
| Get Time | type = Ticks, time = 57642 |
|
2 | |
| Get Time | type = Ticks, time = 57860 |
|
2 | |
| Get Time | type = Ticks, time = 58094 |
|
4 | |
| Get Time | type = Ticks, time = 58500 |
|
2 | |
| Get Time | type = Ticks, time = 58905 |
|
2 | |
| Get Time | type = Ticks, time = 59514 |
|
4 | |
| Get Time | type = Ticks, time = 59654 |
|
2 | |
| Get Time | type = Ticks, time = 59810 |
|
1 | |
| Get Time | type = Ticks, time = 59826 |
|
1 | |
| Get Time | type = Ticks, time = 59966 |
|
2 | |
| Get Time | type = Ticks, time = 60559 |
|
4 | |
| Get Time | type = Ticks, time = 61152 |
|
2 | |
| Get Time | type = Ticks, time = 61511 |
|
2 | |
| Get Time | type = Ticks, time = 61854 |
|
4 | |
| Get Time | type = Ticks, time = 62291 |
|
2 | |
| Get Time | type = Ticks, time = 63664 |
|
4 | |
| Get Time | type = Ticks, time = 64272 |
|
2 | |
| Get Time | type = Ticks, time = 64600 |
|
2 | |
| Get Time | type = Ticks, time = 64865 |
|
4 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\syncronize_ZD24L0A |
|
1 | |
| Create | mutex_name = Global\syncronize_ZD24L0U |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0A, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\syncronize_ZD24L0U, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #10: cmd.exe
281
0
| Information | Value |
|---|---|
| ID | #10 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\Windows\system32\cmd.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:00, Reason: Child Process |
| Unmonitor | End Time: 00:04:08, Reason: Self Terminated |
| Monitor Duration | 00:00:07 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x5c4 |
| Parent PID | 0x55c (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\micosoftsearch.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
5C8
|
Host Behavior
File (212)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Windows\system32 | type = file_attributes |
|
1 | |
| Get Info | C:\Windows\System32 | type = file_attributes |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
14 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
7 | |
| Open | STD_OUTPUT_HANDLE | - |
|
33 | |
| Open | STD_INPUT_HANDLE | - |
|
78 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
65 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
5 | |
| Write | STD_OUTPUT_HANDLE | size = 63 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 20 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 5 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\mode.com | os_pid = 0x6dc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Create | C:\Windows\system32\vssadmin.exe | os_pid = 0x724, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\Windows\system32\mode.com | type = PROCESS_BASIC_INFORMATION |
|
1 | |
| Get Info | C:\Windows\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\Windows\system32\mode.com | address = 8796092887040, size = 896 |
|
1 | |
| Read | C:\Windows\system32\vssadmin.exe | address = 8796092837888, size = 896 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x77230000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4ab80000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x77010000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x77026d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x770223d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x77018290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x770217e0 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x772814a0 |
|
1 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-07-07 23:43:14 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 31527 |
|
1 | |
| Get Time | type = Performance Ctr, time = 7523714196 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Environment (30)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
10 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
3 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
3 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
3 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Windows\System32 |
|
1 | |
| Set Environment String | name = COPYCMD |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000000 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000002 |
|
1 |
Process #11: mode.com
0
0
| Information | Value |
|---|---|
| ID | #11 |
| File Name | c:\windows\system32\mode.com |
| Command Line | mode con cp select=1251 |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:04, Reason: Child Process |
| Unmonitor | End Time: 00:04:07, Reason: Self Terminated |
| Monitor Duration | 00:00:02 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x6dc |
| Parent PID | 0x5c4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
6E0
|
Process #12: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #12 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:04:06, Reason: Child Process |
| Unmonitor | End Time: 00:04:07, Reason: Self Terminated |
| Monitor Duration | 00:00:01 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x724 |
| Parent PID | 0x5c4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
728
0x
740
0x
748
0x
74C
0x
750
|
