b9ba3783...2a5b

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0x8f4	Analysis Target	High (Elevated)	qjhqrs.exe	"C:\Users\FD1HVy\Desktop\qjhqrs.exe"	-
#2	0xf70	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#1
#4	0xcac	Child Process	High (Elevated)	mode.com	mode con cp select=1251	#2
#5	0xdec	Autostart	Medium	qjhqrs.exe	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe"	-
#6	0xdf8	Child Process	Medium	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#5
#8	0xe74	Autostart	Medium	qjhqrs.exe	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe"	-
#9	0xe84	Child Process	Medium	mode.com	mode con cp select=1251	#6
#11	0xec0	Child Process	Medium	vssadmin.exe	vssadmin delete shadows /all /quiet	#6
#12	0xfbc	Child Process	High (Elevated)	qjhqrs.exe	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe" -a	#5
#13	0xfc8	Child Process	Medium	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#5
#15	0xfe0	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#12
#17	0x47c	Child Process	High (Elevated)	mode.com	mode con cp select=1251	#15
#18	0xd24	Child Process	High (Elevated)	vssadmin.exe	vssadmin delete shadows /all /quiet	#15

Behavior Information - Grouped by Category

Process #1: qjhqrs.exe

46522

Information	Value
ID	#1
File Name	c:\users\fd1hvy\desktop\qjhqrs.exe
Command Line	"C:\Users\FD1HVy\Desktop\qjhqrs.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:00:27, Reason: Analysis Target
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:02:47

OS Process Information

Information	Value
PID	0x8f4
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1A4 0x A90 0x 4A8 0x 498 0x 3A8 0x 4D0 0x 368 0x D60 0x 7A8 0x D6C 0x AC4 0x 58 0x B84 0x CC4 0x DBC 0x DB4 0x DC0 0x B6C 0x 6D8

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
qjhqrs.exe	0x00400000	0x00418FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\Desktop\qjhqrs.exe	92.50 KB	MD5: de280727b467a3c874321e0d9faf9084 SHA1: 89b9e6ff2ead2449b8da813afa8c34f52f421fd6 SHA256: b9ba37832d0446610aae07218b31ea25ae68d72da68d8bb70a9e163efed72a5b SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4A8e8wlYsao7xyKMlmuwqxH76KVwu16:Qw+asqN5aW/hL2exlYBo7xyK0mGxb6YG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.57 KB	MD5: 4c4beb67d352f10e6efc89269ced3b80 SHA1: 97c61d91cbfc65203f379ef25fb7dbc808488eb0 SHA256: 81b68952594e8c379f87d331fd512d28c08cfe82ba237628b3f2ec3e25c02f97 SSDeep: 96:2zDO9GTJzUmSoI96gCnLa+cTRb8gYnSuHw9AVkPg:2HOoJgme96gCn9cTRIHeY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.59 KB	MD5: 0ef346e1b51c9f1ff35750924ffc2e73 SHA1: 8ed367ed9878fbf9bda39fb9cc4e1cc0f1635d98 SHA256: 35515e45631b5ff515fe0344acbb5aaef568ab1663ee0746ff8d8bb68a02c97f SSDeep: 384:JVKnBspZ+tCIWUcun7RIDbnuYwoQNOJyEHCRPo4:JVKBq+C2uuDoQ63HId	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 02242d8e28e5a780d5c20d09f8a5e5dd SHA1: a0690486a8197900f88f86ed0977156318df0fbb SHA256: d925f9061fdb426e384b785e21937b2a45166538c561f91c1d7fad5c16c49515 SSDeep: 1536:LRIS7pUATNs83s6g8UOzOgGdE6BCB+mr/qFt6d:cWsSxOgGdQgQqqd	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[decryptyourdata@qq.com].bat	92.49 KB	MD5: 6458ed1a5a404effcf1ab31728f7b87f SHA1: 90eb5a93e829d897cfe1b74ab36078c9fe5e1e3d SHA256: 499de0442a66460fda1d7aff61b152694f505bcff4cdd7f1a1b328e114f0b619 SSDeep: 1536:XiDwzyj/iWobSTs+4JZBjtqqttpe//k15HSUlalGvOHn0P03WDXQ8EMy1BQKv5H4:XJtNZbqae/uwUlakv60P0CQrMy135H4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 284efe2c59ab47ce68d01ab5216be870 SHA1: 2af8857f0bd272b17e171791ef2c05943e492885 SHA256: 75e8770877b3968ca1efcf496f6603ebee8bf4487a4b6c42133f99926bfc8235 SSDeep: 48:hj7erwn8VaAkxQATbQ5lq/uWf/8YfagKtB/dzkPbon:96UOkFQ5lEuALOtzzkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 369ca5bf8fcc86a22f6bbdee2ac23ce4 SHA1: 5c89b38babbff05c53121ebba9153486283dabfe SHA256: b19ee022e5811d5bf0e341f1bfa41f40daf8723222e9021e93fa7d9c200753e3 SSDeep: 24:UlVM+QyuAz2nNxGo3RHtRdYqO9Fs20aWdf7+TcY1RETFpspDpJqTQ0XkPbQ4iVt:zrXACNx7xT49Fs2r1epXkPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 0d558d5c637ea4198950f6b336937f1c SHA1: 65bb06a249aa66d3b43f6dccba98761fe537dcc8 SHA256: 200c857ef411feb34149a6ab5b3078012b2836a23bf284d5b649234a1cf8fab1 SSDeep: 48:9hyy/nFBCPoCzlI6y2tAzFErQSeEkPbon:97cAk6SeEkPK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: f864563029a72f52981e1bccbc2e4f13 SHA1: fcf3d0b359825e1a02084213bd96aa88d42e39e9 SHA256: 47734186fed1c817d394fbe282e04e7e8a29bfdc48ad96050b7ce65f3d8e38de SSDeep: 1536:8TFb8DDXitMIJvKFnMPNFdd2DLoJ+liH8Url7JeWJy:8TFgnXlXFnwFX2DUkg4WJy	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	764 bytes	MD5: ea13193fef438ace5f37ad80d72ccdc2 SHA1: e85ccb94240e2978c7ab967c6f82e44f4957047e SHA256: 5fcdfdfa0dba1e0d21791a4ee89c348ee6e61d8478e61b56dc8f99bd0ec8b903 SSDeep: 12:YhqNRviHoFWJpL1Ecc1QNFNhEbuhI2cWlbT79TZQ1wjNnTuKASkEub5kwxQb2viB:KquHo0DL1SqNdEb+5cWxTAwpnTLkPbQr	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	748 bytes	MD5: 28f07434649d391f03898295c11988d0 SHA1: 1dda6cebb762f85d9664a4889483e7fd9a85d1cf SHA256: e364ad3a0909263e78dffc5287aefbc211ca271a52e42d31207769247c03b61d SSDeep: 12:UEjeb/iQpGHqMlardC3gfRVq/eZQ58kbgNbgu03ZUb0QwG+nTunkEub5kwxQb2ve:BjciaGeZAKRA/eZQ5hIbgu0ChlQTskP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	12.64 KB	MD5: 811027631c910d79c395bf3ebba27406 SHA1: f4d5993872a4d21e5e6ec60f70c0e49d4a0270b3 SHA256: 1c04f109cedbf8770face5e274d73d7aa8949470b08bf90d8e006c505f837978 SSDeep: 192:y50FXM4aI+IYn1lZWoVD9wfoT4L0+w7+fcLBkSmTd03XRf5+/bCH28KPA:y5kTLY1dV6wT4LGCOGSmyh4O214	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.93 KB	MD5: 9b287963291db64edaa2f95548423ec2 SHA1: 012846731c0a38395c22e989aac9c78c21d36604 SHA256: 3088fe718028f8ff0890ce25c92e915ac017a5a4caab4582967ff8db8c68a4ce SSDeep: 96:uMeeT4ZQyxIW47IOUz+CGUPuVAi7bKRr4olAXRQ7AJYTObDwEr1kP4:uYT4ZQyxq7ki7MLTEkQuA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.12 KB	MD5: 6960db7600b8b9b766499700709bd95b SHA1: b9663dbcaab47a02ee2f1573a552bceae617a24d SHA256: ca2fbf0dcb00203b54593e234dddd51cba3223fa409c257f9fece8461b90c873 SSDeep: 96:yA1zY0kzQ3OiD+SscdZQETy/7hxc4lMwhq2j+nnHiKsg6TGCNyZDkP4:yQ7kzQ3OC+oZQEeVlMoq2j+nHnsfQwA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	15.98 KB	MD5: 25871a7bd6bf4de004d5d12d4f9cdc1e SHA1: 16de44fe91ef31c04ce683aed6e4852a3316d7b6 SHA256: 01b016b78ef97e5486bd6937f1c614dedecbeb7bd2f4215a0c9fab3064e7236a SSDeep: 384:kXz5IB9VgSmVHnL6nPN47MEmYr376IFB+5msfK14siai6Uil:kXc9WBnLcKjLFwPfK+edl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	9.61 KB	MD5: c22418576a822df9326f0065d642e05b SHA1: 6c2933886d4bcaa9c8f31461f3946ba0219eb0b2 SHA256: 05493eff7111fef0612c221faa3cfbd3fef5872677dc6a68febd1455a7d2dc9d SSDeep: 192:wIOUBGt9/xy+n6kO+WodXYODMvRJ8mjV7IHmZai5FhavBanIHVSA:7OUBGtRx7nPDDmXjV7omZjNIh	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.65 KB	MD5: fa28c68728abc298f87bad32f21b9493 SHA1: 6e7c2567710ecfd3c8cb7c5f50eb822e2bc2e6b3 SHA256: f840504f141b725343dd8f09ef0483ba8bfe7f1e4406afc702174f12cd0a8050 SSDeep: 48:NhWSkv6uz7JoPe0LGJUEGfaepxtgDRYgkPboB:uSfueGfJUER6x0RYgkP4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	381.42 KB	MD5: 82147cd0ac6c535174d45f8fed945e3a SHA1: a64b8a2ffc3169daa63c7cdd1cc4737708f2172d SHA256: d90bbf5ad61e71c3592cfff3bcdef82e176e8e2c5fd2dbd89f96d2730578b74c SSDeep: 6144:jssdAb60QJVNG5uYHejrgpJACj/vLowR5FNVn+UaoIej/oG3oamxKmBlWRy+CaJt:jssWb6FmjKw7vsAFNN+tzecYoJKElAyI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.92 KB	MD5: a385aee671b1fdd48a4e17ed861107fd SHA1: b71fc95d41358a29c16e44abd468a640bed2d6e5 SHA256: dde59116fd1fad178597e6be67030bdd0def1c68ffbf94fbd23db5778f00a6bb SSDeep: 48:K3e8h9Yk5JU8i0P2RqGp86Oa6NPW7ib7RAYXkPboB:Ye8kk5yQiz86O/Gib7WgkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.79 KB	MD5: 0adb8281211e293c7fd3b422b51a4c64 SHA1: 1d8b9afd7a87db93472bc9282ac84a1d3637a91e SHA256: 589837cf59aa9d3d371f80578355c27ac787867147905f3555d1f84514289ee3 SSDeep: 48:ozHVr97+5Jkhh3KzYRuta9LU5q9xo9d4kPboB:ozH99awhhMDtQLU5qvwd4kP4	... File Actions Show Properties Download
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[decryptyourdata@qq.com].bat	41.97 KB	MD5: 90edba75fb097c3b802a40a37967e56c SHA1: 95b09cbcc256b1fec806b7b350c078753f860425 SHA256: e27014f6c5fc097c0a533baa0b3a1c8cc5109ccf271869a9534667e9afda1f41 SSDeep: 768:71+GJxY1z4rhtBrVUyVz8u5gfnRuyhP7FFwgQtXs8zxofhqX2ySpNQ2hi2IVpU6:71+GJxY1shtXUyVou5gfnPDjw1c8z6fI	... File Actions Show Properties Download
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[decryptyourdata@qq.com].bat	320 bytes	MD5: d8c1116191fcb50c64ca1445a61ca28c SHA1: d439ac8acef819babd91a6230990804fe4238caa SHA256: 9828a0d0fb0a4c787f9b333c4f06b4b6a5b5380d9e7c860ed9c4eb8f9c16461f SSDeep: 6:8e95fkel1DmRH8lD7gNToLpKJax9ukEubyK1uwxQmk2vpMzuLAt:8s1UH8lINTu6HkEub5kwxQb2viaU	... File Actions Show Properties Download
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[decryptyourdata@qq.com].bat	6.14 KB	MD5: fe13667afc3b58c0ed27b80b6f251a03 SHA1: ea1921e4bca54c23413ef345feb944aa6ec06cfb SHA256: 376f5bb2f8cb9ed33ccda616fb7492f46c3b3af2a73e2fdef1434656cdb1d32f SSDeep: 96:s9QOK127E/ACihK5nQZTzZKnR2/I93Bj3A/xf2KYEvbxR4d4Hy+8EZDMkPQ:s9QL1soQIQZwnWI9RW/YyxR4P5qI	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[decryptyourdata@qq.com].bat	416 bytes	MD5: 6c86ae7894f005963833135b685d1488 SHA1: 0b9dba8d814713eb2bb4bf41d6b90471584586bc SHA256: f43fe7f222c2b44e9f7cf02aada432c3f9eee92496351eed8c77ade35cd2b012 SSDeep: 12:TGDHyYNXV/laq3TugVkEub5kwxQb2viak:yDhNF/laq3TTkPbQ4i9	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	378 bytes	MD5: 8ff8ddab85585629d94dff6f54844a2d SHA1: 5702f8d74b26f433c17b1151961f4aa5b1523758 SHA256: 53e220f4cc64ea799fb9caf2e6de6907c9be7c9a5972ad9139f74af51880a630 SSDeep: 6:P/JEFk6cUqG36o9vaNEZyAy+dZ/U6WCTToLhe4q/lZ49ukEubyK1uwxQmk2vpMzH:Putmgx1tZyX+zxTuoDpkEub5kwxQb2vI	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	378 bytes	MD5: db6c79398ef235875357bbb6ac2a6567 SHA1: c69388a494234cd75a4b0cc17f68646ff4c56ddb SHA256: 43a8e91e44a2543291d93beed3042f2ba43d409d7685dc7fc2ea9ff807304e67 SSDeep: 6:iNFOcUMUvwCCLIbh8QFj7VI8Ak/FtTti6WCTToLdNUKS9ukEubyK1uwxQmk2vpMr:wAcUWQt8Kj7VptTHxTudNLvkEub5kwxS	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[decryptyourdata@qq.com].bat	140.95 KB	MD5: a2d61a2dcc82cbc11e15f7f85de39009 SHA1: 34e71543dc27af69e5b26d82ad5894fc5b882743 SHA256: fb6d6d0eb6c82760b55087c18e42911266f8cd3a7853dcf0ba6453d49d5309db SSDeep: 3072:A8CK1aVdFv5I5S8CVkDPMMsg0aojSXZncwwPyoyu:OK1aVdD8zMMsMomXZnDwPyob	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[decryptyourdata@qq.com].bat	314 bytes	MD5: a7152e401f4769924c2c095edbed5d7a SHA1: cc1652ebb28de1a5e5248d9998cc4261e2d8d2ee SHA256: e432749f7a3463cdcdb4c0b1a8061183f88e91807993cdc0af0f91f8eb494b79 SSDeep: 6:dzcZpVuGeKs9EmvCcQlSaBToLP0ErWv4uhfyauL9qDPRUKdjAW8n:dzcpnypxaBTuPraDra4NyT	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	6.39 KB	MD5: 59e4d27746ef45019a06814cf24c4ab2 SHA1: 950e5f8910609c9d4b45f29ef66fb68ee33bc93a SHA256: 3cb12091749da9bd3aa65f8436f689a1183f8b19ace45935dbab74288dd920bc SSDeep: 192:q1cQNeRBYEzrWnrpFtRltRuLsNRuHt0Tz+f3IxEY:z/hgrpBtu4RuHt0X++	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.86 KB	MD5: 564fa5456b16d6758d1826396d8efb6c SHA1: 8d7b33d466c06fff187d02b7920982cec96586f4 SHA256: 5b3711791ddce5f6ca3cf43d8383da5cfb2a2870cf0db3e3f77c082ee191f465 SSDeep: 96:22BO42Septf8gd53J6Cjwxbw5G+STOtWcvsawkPg:22MfN82cCjm2G+S6tWcv3Y	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[decryptyourdata@qq.com].bat	852 bytes	MD5: 53c6656f99db3b018839e482a208f6ce SHA1: f9ebb1b195f97d56545c4b646738896d28f40911 SHA256: db406295fcf94c7a7853e2385c4ce8b847d6137d6faff0411ae4574dff10bc98 SSDeep: 24:aWOnIHl6Xd5QJl3GPqjnrj2h37eH8lHTuW4Mxn:zOnIUnERPs3g8lzt4O	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	59.65 KB	MD5: 30782454e73153bd6ddb3001f62a6f61 SHA1: a8416a88e5f73a09865abb6c635265d1631d4bdd SHA256: 8ba911a515b7de4de34f804716b4da97af76d579c92b2bb97ffb0d806648ae6e SSDeep: 1536:ssy6AvoCtZKHqhQwuEP+ikjE7vShOxwAlj3EOB:ssHAvFKMgerShOxwAlV	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	79.32 KB	MD5: 88a2bed0e91bab00d531eb76bc6b1dbb SHA1: 83d981093e72b5fdea4eeb6749455c62a0ee1e57 SHA256: 9102905ad107f48134c5d748fd2c5e65e8b0ce4da645de46eef0a17b5bf1c5a2 SSDeep: 1536:GpAwG4CN2DGRlFK4aR8NW1q8G+ASkGAbOmD5lNk6163yDhUOHoZiRKB2sA8ppD:2rGiefKljM+ASSaA5li6M2oZiRi3F3D	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	14.09 KB	MD5: 76605e204e1f497f7485515acc785e56 SHA1: ded5d494ec13cc60c4fe39e09cecf7c430ae21ae SHA256: 79f88e573e7445b6b6c2d68cfd4aae9291213d3378320cda10256a13cc2470e6 SSDeep: 384:Mq26sYpN4Bekb5Qrj3F12avVnCzwc6uHPAkEaeD0:ML6XpYekFQrj36Uxc6vkExg	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[decryptyourdata@qq.com].bat	566 bytes	MD5: 43e6b7625e853cfd9c0b192f896a491e SHA1: 6d1c92dd948ed94e9966591dd93def7c1cd8b86d SHA256: 4be077f0b6a14921ebeef683d40cb246efdb122229cadca880b0329608402b20 SSDeep: 12:WqmMsNXzKw2JnbhwnKS1tVwEuFH8lHTuidsra4NyX:1suFbS/VQFH8lHTDKW4MX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.59 KB	MD5: f8a67e98a854fef1ca2fe9ff64f1d9d2 SHA1: a658b0322a1f966cdc79e43b3bd445b4942fde1e SHA256: 9cf18106f1d808715ed0828f474f7924331082aa823e5c1242e2c61868aa93d0 SSDeep: 384:OdbhkCMHBVlO6Xk0NjB+nlgbyRuFJTdojeWmiv3moICLG+J9hAST:IhxMHB7O6XLhB4OGRuFEeWjy+pAA	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	76.18 KB	MD5: 5edc35e578fb43cce9364cd42e91b5d5 SHA1: 1afc7a6e2745e87df916f6d5178ee0faa6b9bb8e SHA256: 0f51bd36d3f0b4ca150379f19e8ca9be507e36933e6774abe248974629018974 SSDeep: 1536:wIBtUmwOEK1YEvKSnY3MAKRI8yFohoiIhT7DQ8BeDjhrIk66Ox0deYflw64:RfUmw3o8MAkVyFxBVDjeD1rZOx08Y9K	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: 3a0e3141655a4cffaa0c718a25ba5932 SHA1: 164fe8715562d4ec7e4b98db58ff4a5744fe5fe9 SHA256: 88a78f0b5fb5e88c846b06483cf741b232cfd9bead407ce94b6c7ba2da946ef3 SSDeep: 384:IlkEZtZHEebKX4IkYekwK2eOD13RbFfzVo3yqW51CY+utAWMAUjfjkZuVC:x0dKoNYUv/zOyNCCt/MAEjMuA	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: c8b3c8ba4ba0c747269a89989000de82 SHA1: 4d9ebf28d424066bdc27ea5ec131ad19b1e619c3 SHA256: ac0319ee4b85d615db6e4297fe1b4cf92b6b25d3f89ec0e3c39a9cfb0632cfeb SSDeep: 384:MGP0EvdNrYb5XFSuR4Zhj6hAyKX7JiYmJUrEgAnW:HP0WNrYbJFSu+wk1mGEK	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	19.09 KB	MD5: f11c0668887e3d50115dec739eaec545 SHA1: 9ed11f8ae5897b7715c0462c078a86c377992057 SHA256: c55b9c971111fe0194eb07f514337f65caf86561ba81277e2c03b3860f870dcd SSDeep: 384:ig93jSJUNGyTTDKsKEq5Zv174fccvJX3ilit+qdiFMOj:J3jSViTDKsKD9mckJX3iYA	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	17.09 KB	MD5: 253a2bedbff375f5c8de606fe183fbdc SHA1: 5f77f15a46b8776f35936a891e3c75063c6186b5 SHA256: b3eb3f209e620900258927bf12a81edef16828279a402edaf185d75d3d9ee87b SSDeep: 384:6tuqn/7fxAYxl69we+5N+3p8boZoskEVgl7fo6tp7xlezpSY9SR5UM:64CZAic9we+5NY8bmoVLjzpfeYY9I5N	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: 620c3d587f379ab242986aa1592b8bca SHA1: 8829b9309eee4bfff7f3ab0f9ea96815118f267e SHA256: 00065598e246c49eebaa321fbc73c7df25549d3605346e54f4ceec800465caeb SSDeep: 384:tCYzwK5KC4vN48RewxzkyjpsgIkl1D4Q6bnpypB11/2HcIWwjNpgoygm:MvySxzkylsgI84Q6nyB11O8IDgoU	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	80.66 KB	MD5: 826302a2e290270172b400cd813c92a5 SHA1: 84e8626c8e3af235f525e81178bd3903ee07b5be SHA256: 9b6d32ebd4c3425cf3ae49e6a4a880e0243fe158ba45fc5afc1a7d436fd36e75 SSDeep: 1536:oBzqH1ly9ihEsmGHxuxw/BnRjAebmg08VRufaUwv6vv9qcvYSq7+sE:QzqHfPmsmGHxoMRjx30eRuWv6vVqcvY8	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	16.59 KB	MD5: d27a8beec3f5b083004bcb3cf1645099 SHA1: f9aef36404bb6337672bba74b112f706b2d39337 SHA256: 03adf9f303baebabaccfad4c4e11614f969a16f284dfc0b0111458abca87d5e1 SSDeep: 384:xt3aiu2E4DsmcFItjdAdP59Xm1XZKE5xt6p18TSV70:xLJE4IyvwzXm1Zn76pO2Q	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.59 KB	MD5: 4ccb5bcf87bb0801d0185c6d276f42fd SHA1: 603f9996cd9b131a8d7ae13960e8e6e206967747 SHA256: b6f7c3855b108d5d3c8e14cd6f50572e3723f98f66f852e38a1e39a13ed03a40 SSDeep: 384:+wWnyuyH67LYRJ1uj25zYE0Zp+ZvS81zkb8tgXFr8tmTFG8o6KlvtdhdFHNk/49T:+zyu5DjVtX+Zq81o8tOYtmTF/o6evtdx	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	15.09 KB	MD5: 40bbb07decc3874cea6ca816e042db23 SHA1: efadaf0c8ebcbe1284696fe013ab085a37a77b42 SHA256: 382233ffc6c9cf69722a1d8b4c49dc770bd4c0bc618af3ea1f430c525d12e9db SSDeep: 384:yZlIERcQrFNiBjQBjLt/LgF9WOcPJbvFJNxQZ02pcMmVi:+PcpCgtcxbvtulpcMr	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: bb5900c32ec99f8b4bb90c94e0cbd9d8 SHA1: 45a212b83c942057ac2ef8485e338b3d9d8a03cd SHA256: edce8b0b2725a3759b036819c6591d6a3bc16b8497745402c33aae20572fc3cd SSDeep: 384:2dcliTNJV5RNIzI1d7z/4mck++2MUd18YRMWu52V2BLMyYjLeb4t6e+Ox3rL:huE01RTt/T2MUKYRMTkVYY+s0e	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	15.59 KB	MD5: 5a051851c591e3c14e2ede8d98f5c650 SHA1: 181ae3eedd72dad993a01afe65324025fc6024d8 SHA256: d74a283629eabc5bff64a19bc899b550cbcdb5d5811bde00b85e74d78d4d65e5 SSDeep: 384:1d2p5Ws9Pt/rfEwMBnByHI80bQccCnHmWZjTxfNEL5:kW0PRrNox8gnHm4O9	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	19.09 KB	MD5: 8ea187257bff7ea8ccb28722ac71f63c SHA1: 0c8a15f946dd995f9ee346b23c4ebec9a7dc0650 SHA256: 8fbe324205d2d7f0a76eba6e4d87d405e8c9cf94ed99f32ef5f4adbb33091b94 SSDeep: 384:mEfXhdk26eQFqr8cfr2qHqxeUCsfVuueYVMg:FXhG1eIqrmriASYD	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	17.59 KB	MD5: 42699782e1ddf628bcdb25955d441e96 SHA1: 6667c08131908ad3dded034f6e42765cc322c2c2 SHA256: 1bda395f0ccd382762fba655c8a0dbb2285e4e94ba04d66e1014345dafad4d35 SSDeep: 384:J2KFWuJDAsIAmLBI6xGe5S8LeGvmJ2BulH+iXdVyD+e:AKTDA8mLBIVGut+ydVCx	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: 5aec8ced5fe5a1414b679f0b1f413b72 SHA1: 6429a4ec79baad8b9dca36eb48cdeacba049c51a SHA256: ce0f52e5e17808c0025f3f12f037484f2e1846b20e5b797943935fa231e41b85 SSDeep: 384:E3LnqtMH+6aWee7Zz6suv/eFmf8KJug5tGq/K0eAlokC/ZKxsGoLj3zcApq1oJ:EbqtMHIVe7x3krf8Gf5tz/BH6+sxLjjP	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: 0011076a8705d5e803a63532604ba578 SHA1: bbfd575a6a82411b8d112f9c518d32fae4691829 SHA256: a84752a16448ec9e4708b39e642b37c02b6a36f878b9d91e4ff1a087a73056c2 SSDeep: 384:XEdoIk99QelPfBFNG3Cgq00qcrzYAf1zy4sDuzWGaZZSvM2wAO+zHK0qi3r:XEiBzlPfBFs3CFrEozP3zc6vMhAbKZO	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.09 KB	MD5: 54ca62e26f2b50d37cc72b15105ee498 SHA1: 3877b8ab3d8fcd924370545eb250bbd0064d19a5 SHA256: 6cb5debec7bebd4e6da1c54444a113127bc807efca42cfa2b1a6f1a0a3c944ba SSDeep: 384:nNV27huquqrDb1F0Xe1sktaFJXBSqAG3YZbC/RBawvaN8q31xFRV:nNVEEqnDf1s7xYWb9vaN8q3J	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.47 KB	MD5: eff90c6afa91d1a5eeee1f3fe8f9c7e6 SHA1: e16eafdbddf8a88887f84e00ab4b970837b5a750 SHA256: c8dfde95d961e537e07064c0f2e032b9d7b8572d847b6ab1c4a284e005c49eb0 SSDeep: 96:48qL7r74AD2RAjwnfhSd4RYLsW/e4IC9P62PokPg:pqDsAD24ofMd4RYLs9+P62PY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	17.59 KB	MD5: c285defacf54233c900eca7e8254743c SHA1: 89a16548e37b945d0f6a7ecf4300bde07879f203 SHA256: 9ecec7b8687d4d6b982161a0b1973071cd3ce5054cb1dc6e6b564081241c890b SSDeep: 384:+nAEZmlZtLZsIxX+9sjpdcnR//T7klLX7jhkAdZm/YyHYNoUe+eSB7ne:sAEZqZtNsQ+9sjHup/0LX7FdZmwyHCe1	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	17.09 KB	MD5: 5640bfbda7292a3c9e947d6acde2a5ed SHA1: 18059cdf77d1b08de2258091d28a356f04e6024b SHA256: 48dc4c0cf0709e7a7778239acb2eaaa022f856072223ae234bbe45f01e9cb0c6 SSDeep: 384:F7nsh/A6djjohtkoxnflwvkbyUfkU36GvZ:FA/AYH6kgfy8MAN	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	72.72 KB	MD5: 5463eeb8aaf48d469f7f85cbd2e282df SHA1: a228dfff8708be52b86fc7704be2072bb02654be SHA256: 87466d851398e49ac773c765d39f5ff8b9252193c1a8487b335c6e80976b9a1d SSDeep: 1536:95KUojRUtXsjSFG5qU3gGQSSmehSUkKKJv/MnTPz35Nh+tOQ:95KYuSFGEmoSUK/u7K	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	7.61 KB	MD5: 4a453252e8023838dec8342674adcba4 SHA1: 75a43f4a4f9711998dab6f91ffa65dd8a8e09187 SHA256: 0a43c579c00b70f8c805e64a60dd2ea31e16edd9438ae5e57d2cb3259631d384 SSDeep: 192:aQZ6HciLa9HYyZCI08tZ9TQ/2yStw16MyqQkXTcOSY:aQZITsYejQ/2yv6MyJccOX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	8.89 KB	MD5: 59026e9c27c8044168453871492fecc5 SHA1: 28696fb8ab23932ab72b65dc4e930580013229a6 SHA256: cf20a3bdcd0d8e4e507104f4ba98262b05fd5482639ede6a8470c68f372ec572 SSDeep: 192:hVUJAyDRAgpx2hhoie74JfAwb7WoYclERgnR1vvPnm+WNwWVY:KNtxJie7SlPkPgrHfIwW+	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.59 KB	MD5: b04373790e0571d58342cc160feaa07d SHA1: cae63b8b42d572c641fd804beb13190424cc4a74 SHA256: 90f4547759bf71aa1e939df85d1b7a0988aefd14e316063cc0dce1b7b976fc6e SSDeep: 384:2Ppb0cIeteZqBTUct5x9azTP7YYwMUToXsS2Y9YKPfWvr:I0I4UBAcl2ktMU0XbPI	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	14.09 KB	MD5: 119341698f686b09910e113a12d93509 SHA1: b53c30ef49eae2a22b9af85ed649ca332ce1c181 SHA256: 3ed7c593b63f11725ffef9cd21774bf39bfda72c15a5a186fb4685bbf57fd26c SSDeep: 384:4B/kz2zuApaQ6gcnvNBBDYbmqU2QGpVZ3qgY9c:4B/GyuvNBtYbU2QWagL	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	84.51 KB	MD5: 4c450431425d4a9b3bc9a06a8904d8bc SHA1: b1235494d5bac226dda247afb79f0f5174de3a16 SHA256: cbc367cae2ec3bb8f17bbf7302ae2773f75b1e98a5928cc57c0be23c17862be5 SSDeep: 1536:O3mL3bTl+QJr5hB/PW/vcCItKAB/+mBjgOtcN5SbyR12PPjf7/Dby18nBt1n:O3I3NJV2hAB/FBjgPN5AT77I8n5	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.35 KB	MD5: 9926c103231a4ab8f3a7c1459d333ace SHA1: 8ee6ab358c08d8df3feaffd7ea96c2ee9cc7c4b2 SHA256: aae73d51c5cdd8f9e8765e9a284bf406f762ae837b85659c309db8d656ac408c SSDeep: 96:Ps2wHmiajaHr8ftN1pMz/Hl2oAMH24oZkPg:02wHPajZftN1pM/FvtY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	17.59 KB	MD5: 20d6711ab34edd50a606cb6cac6e3070 SHA1: 618c3a1fea22221c4053853af5af485031b85f2d SHA256: 2ff3231ffd5065394fe85898ca2997311dd9c92c62ecc102f4a90434a03bd0a9 SSDeep: 384:hbkLO5VP6Y3+Zs6hK6VuuXxBkrhS2IwsfxY28RnK/pWxqTYm:uLId3LnOuuXnUhS2Iws7CkWxqTT	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	75.68 KB	MD5: 8e9a6093293900cc454e8a5e400eaa90 SHA1: 4bb25dd7e2fdbe9d7a9132316bebe4332cf94e0d SHA256: dc63988914eadb2d915b45c66f068caeca75da4e9032343a8037f2107ffbd240 SSDeep: 1536:TyrZCvbJaTW8kQUjC8C03VdwJLegMhwOLpV7IJjrMr4abDrV:TyrZtTlKC8CodwjMOOLD7QYkafR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.85 KB	MD5: 45a8d04498f4661ba27a905330a674d7 SHA1: 96108b418cbf55882396cd62a615c01817068cec SHA256: 205ee52ade3d7be0471e04bf247800df713022bf266a6691eee01d49ff83f4cb SSDeep: 96:rUfyIP2USL/i/VFY0t2Nph9swj1w646BskPg:rUvPiiPa9jU6xY	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[decryptyourdata@qq.com].bat	86.71 KB	MD5: 488e7663c21381b83df345e6c3297db7 SHA1: 6c65ff1962d5a71dfd7e8fab27c075fd627ccbe0 SHA256: ce6bf110de842c6e42237b25ac36e65fde0939bb36ebcc3cdbb65a497c4fe8f8 SSDeep: 1536:5m9BMpAWbgLTLAbGCxeFKJMuBUZY/wV63gB1JkvPpMUHXm9xQ/EI2Wv5gWIqUx6X:529PLwbGCwFcHgCMUHXAy2IBU+	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	14.09 KB	MD5: 9715286b7af64d1aa09ba1272d6fcb17 SHA1: 7b86c61def57c0e0bd31d0e6797ef50404c5cb9b SHA256: 620e1dda5f2886022ac09ee150d1d493f7f0a49058bc6ce827118d954e263c50 SSDeep: 384:Y3+gTCd67CJFpQJDwHJeMv7hMsTaDxH8v:YC6YQ9e8+7hMsTIxcv	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.68 KB	MD5: ee75c02493f3563b39289502a1d45bea SHA1: 7dc7c7cc83e69332dc9b029e87928def077d6b64 SHA256: 4d1b1f825af72d951398bc4db151dd0fab358cf31483e89c098eb9db0f34d2c9 SSDeep: 96:Y71GKeLfkKe1ePnNKmfEhUULMejcPB50hekPg:BKeLu1INnfEHLMeABq3Y	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	6.93 KB	MD5: 97aae48ad1e9e7df9716944f3442a7af SHA1: f94a3cc379af969f6ef11d8bff1fe4097ea67dc7 SHA256: 876a429627cacdb57ea03dcc4696824cceb8bcd8e95dd848c59d850fdb75fb76 SSDeep: 192:HTAF7eDchWB/0g8rgPI39Cpxs5NzMxqAbS362PY:ah+0g8rhCpxyNA5S362g	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	75.46 KB	MD5: d89576ba4006b24e13dcd67723c23867 SHA1: 79aa52156c48ac7356cff9eda78108b302b56ff4 SHA256: 2c9987dc9335253e50f3659fad7a52ca88a470c2344825772d2207b3ccf56116 SSDeep: 1536:LzeOHyOC+NvM40IKj5OrFOkl8tElQ7crBDmiiO+/1AU7:LzeO7C+xM40IKNOrh8tElocFDmFd9L7	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	81.27 KB	MD5: a9d8687acd43a21ab08463240057c7bd SHA1: f24866a38d2f55b59feae0a34e68f1e6959eab73 SHA256: 8583c626dcaafe76258f614ba2222357f9bb30a1bed7768717309d72f006ddba SSDeep: 1536:/9Kl+96niZbiL46ZLc8ngAG/YJdKN7hiQIgBOcED:/92UGipYdLc8gQkN7h1HO5	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.59 KB	MD5: 6189f9e86b97ab28f3502e88d8343abe SHA1: 94e33f3ec48482ae0217df0299d87c8be3b501a4 SHA256: 57c00ee7d51b9c82e424d0781d703eb536486d7adfad5726ed2fb8e5cf7ab34c SSDeep: 384:RMAgjkC7BggT7EUaGUbfBiC30uCTHv1y31W8vjjVNRoMPdt:RMZksBggT7Eh0CLlVbjVJ3	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.35 KB	MD5: d5b7c7b88e748bafdbb8a626e7a4fbf9 SHA1: 43315a5fcf9dd0f1a7090b95c342df65569bf2cd SHA256: bce60fd2cbd13a8a35b546091d8f2d7124261d31cc26c6676a38a6d102e64a39 SSDeep: 24:fafjQXsHeT2ag1RGz+ltUvH6zKC1gUiZQ1T+BtPENUG/DrVoPTYHW4Mn:fSQcHemRGQ7NgxZ2ydyrV+Y24E	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 036885883ad3418f421bd91880222e23 SHA1: cd626db6d598f8f7eebedc5287df4a20cc04fc4a SHA256: 92496ac464d3d1f52a38968e355d671e5760a4b4b05292125e88bb4e60480e11 SSDeep: 24:e3Gon9/WABXXIKoXtLI04HB8LDfroan+A+mT94PW4MT:bo9/JIKUtLI04sFK+d4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	70.63 KB	MD5: eeeb1c49368f4c0e9ac153d60fef27a5 SHA1: 3e2d3e72cb2338e5a043d332c52d086b2d8837c4 SHA256: d70c5aa32562d9ae65b54f5546d90de399684ea8bc88e601f62d93b9fe87e229 SSDeep: 1536:Pa0p+I4mVRp/GrrOs1jtFDDH0GUYgvOyrLCWxN8+/nYnFx9CDaXciXTwcwBoTGpa:/krmV3/GrbVtF6zrLCIN/nQFyasiXT+0	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	4.38 KB	MD5: 3eebcbca66e58ac734650f511ea0116e SHA1: cd52f6581a594ee75c81b35c6fcff82a030857e7 SHA256: 69dc737e64ad83d4ca121e2114e7b6c5c05e7b40798dd01b39aabb75fd71bdae SSDeep: 96:C4K1cTlKk+ufr2DD0OCvVFyrdS7mNxxVm68cVSGCgL5IQfWnGxBEvW7rkPg:/J5KTufSUOdS7aG6fvqhGgv5Y	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 5197b09ae32707ebb3f64d7e282472b1 SHA1: 9b71208f83b787ac352b596afff00315c61cc93e SHA256: 75c56b84e3ffb660a2a1b9ddee53ccfd4ac842e646c5ffe0bf64e816295ee166 SSDeep: 24:CxonjAojoNeqVcTMxAdi+94xUTs+EW4MT:rjNUlmMxnGsE4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	84.66 KB	MD5: a0cd5b3c58195cdfc1ea3ba2a8127d02 SHA1: 68f476d21b548c86cc25919458dbcdff0326f533 SHA256: a8a4f0a8805f860bb680ca2bbb1a00e2a2495112764dab75435584b63ce13eb2 SSDeep: 1536:AC3lUg+F6wBYaVMJMJhw5JwAP6MNcbV4ohBNJgc5Sxdo2CmJ7K5uBr6i7St49Qje:ACVUgM6sMJM0vwAP5ObV4OvUdo2HZK0r	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 499f24d83abb94cf5bebf3abcadc3781 SHA1: a31944f3dc21cc253de137625c5f75cb3f3b8a62 SHA256: 7fa396dc4d6853e31b8dc07e580c7ebd9ac14a96969bd9504adb9fb4c5857f8b SSDeep: 24:6SFecu7Lo24Ozvms0RRltvNU28+JJmqrkMKra0eATsW4MT:6SFopKRRHtFU28+JYtvrasb4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 4d1099c3b83b8db5e23a38721b037e9d SHA1: c7b5e25d94ea65a4b2a77a7304bd16447faea346 SHA256: 288cc9263f12a3842ad841804b32111954febe7dc04b716764f401c4c4aa139a SSDeep: 24:ElBgTUyTdCyC4rle45GirPVlJiH7WGW1U3T8LeW4MT:q2AyTdC9hwlJiHiDUDg4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	78.43 KB	MD5: 5ee280e2f6a6d4120d057c9133d17a03 SHA1: d321aa2c1251322b8572e00109b2e19c28156cce SHA256: 6b4583717a4aaf24fd0d2c49ad8c7bc6216966c112f2beae1cc91619019491e4 SSDeep: 1536:usWGFx/EFotGZj+/8+FB3eBGdvZh2gOt1VZJXUfNzp2Q:lWGFx/uotQj+/rcf/TdXUVzp2Q	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	66.88 KB	MD5: 87ecb7780c183a55170e01e3997ccf55 SHA1: 1f7bee969291c96f2a8ebd6dd52bd462d13d844b SHA256: d745e6759e6efe2a19df18a13f2b79972b13aad7882bad390e23132bd22d7b9c SSDeep: 1536:x8+a8yIvKgfPBSR1XvF/A2K8JqEgcIFnZA9xWYdVv+oyw41NBNo9PeY1:2+XfZSfXdY2KbEgcwWtdMy6BC1	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 1a5762f7d3a53ac2296c4920ec55e9d5 SHA1: 571752f129183983bd11bb16a6b05cf95cb47fc5 SHA256: 7ba34d9570cb1ac2d6ee4e16ada5c4f3aee25c03b06efdfc6d1b9e3151c9b77f SSDeep: 24:3YrJPjDX6ogdw1ATGnryNTaC5Q7cp09VI7Np0hdC33TqW4MT:mJ6ZdwMGWNWIsc+9VIUhdsDJ4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 07201003668f12d133d0ae4aa8d37c07 SHA1: bb6e8a27b544ac43b58a8014af83eb8f8cc2d27e SHA256: 55432fa6e89f8bcea14029cf6860ddeb2ea0457ddfb896ad0447cc41479cad43 SSDeep: 24:YPypjtiqhkKhBhe6XmdJALNHorimPsDtUiNAiMAs8MEvTnX3W4MT:YPYjoqHh33qaBGdPTiNo8Mkn24A	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 4fa80fe5f9985703cb28f9e1573f5137 SHA1: dd2ada78dc886b6ec46b8e2c9592c8ec37b839e0 SHA256: fe4401cb2002ea9c1363e9e66039fd7af54d64ebc0268aba1abf37c775896bb9 SSDeep: 24:5X/MhN4Dv0mz2DLCF+kA+UZ5xF0/8TFcW4MT:Z/MhNivfz2yFE+a5T0/g54A	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.10 KB	MD5: 31506ef2b1932fea10c2753e13db4ce9 SHA1: 77f3849a1735679dd8a225fce2e4ecda556fda71 SHA256: 61be249a7e5abfcb55cd927422f8cfb8ef7ccd88fe381b1896718d6b903b936c SSDeep: 24:mXfdoTDshZi9QPCqoNgYf9spWS8zat+fMTAHSO79j5xG/BvGb0eNBTyyW4MT:mv8AhZuNf0X8zgnTAHlFaZvc00Byh4A	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	63.96 KB	MD5: ca7517892816e7b67e3d7a02bc9cd39a SHA1: 319f29374c1265eee30dbaf751804e973bd8bdc8 SHA256: 17d74b8d76fdf4c4b5dffe89dcc27eabf651e3a4348b97fbb863305be36ca39f SSDeep: 1536:pOfGjlOtLpUY5i0zKf1Ks7hNeGO+EhAAUiU9lyv4mytw:pkGjlI2Y5Rm3reh+EFQ9la4rw	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.79 KB	MD5: 4269a29873c28e17e147dfa43d55d301 SHA1: 8d48a38a667d17f14f3943eadb6a8765f253b236 SHA256: 2b6b90d12f92d1a702c1f88046228eb4d193eda26641cb340191eed64f6d1838 SSDeep: 96:8pq4Xgk8xEpDUiXMGOoBYB06eij/bcIiZbx9uO5K6XoeFxymnBK0kPg:N4X9pgoMZoBYB06es/bcIEt9XvnVBUY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	78.02 KB	MD5: 8a0b5a239efd1bce1d7ec0eecb4d1285 SHA1: 580cf7b6ed7824cffad344f5f44cf8d2dd139db0 SHA256: 01529479057e5793a1e9ef44bac585d1cd6b696b3327af69963ec5c63eef3609 SSDeep: 1536:6WOHY0jcBRg4YfOwaAV9F6kJP1kxQ9YYJcNPtnW62MAoVAWm5hd8Tfb05vpc3A:6vHY0wgfraAVnJP1sQKgcD/9VaoT4Vpl	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[decryptyourdata@qq.com].bat	10.13 KB	MD5: 13aa15c393d9f0cc00e1f4edd76a2bdd SHA1: 6bb33d18b8b3a23717d082a3540b381b2e3d6c0f SHA256: 2ed1449ce2f78bbba879e00487adb33b0dc576e8334521bf91682acfef2a3dd8 SSDeep: 192:g0KPZbm6StNWaXGY0pQSXNfexIwNYU60ET0c+io/G/e3x+:km6MWExDWebGRrT08NEx+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	10.11 KB	MD5: 6c28f9c6ff35795336443ec75969f87a SHA1: c71a85257b4825e100d75d5ea32aa71493f205f5 SHA256: b9e81cefe23e0fdfe6f47e0e60bb671012b07c7557cfd3c4270fef3fd5af54f0 SSDeep: 192:dD5Jb30xsS0YHKwQ9zlYEWeLh1DYTa5Sdb9WwNePxbGrX25viSOY:dD5t30/tczllWe11DaGSjWwNA1iG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.69 KB	MD5: 13186c09329ccbb003f66efeffd77892 SHA1: 6a05ed469efff3ae3c4b25d6531b8a667831c83f SHA256: 0d185b3001314fc5ab397a19dd2e11e1d643302a643261cd8427d29686030705 SSDeep: 96:EUzew/Xvy/QV1EzFYntKUlTuNFyR1y8U/aalnOxGCIbkPg:EWXvyYTEzFYoU4FyfDU/aa9GGC9Y	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	12.61 KB	MD5: cbcc3e5691e1849ca0e8e7d917488b73 SHA1: 5807e5625cc4ad9abf39b18e984f0256b0564ba4 SHA256: 1cbccf2100e63ce12196346b4702a1d10c2f8a43d9606267b5c259af4825cf28 SSDeep: 384:itQH1CckzbxbPUBD6gh+Kh5nEw0jExTC/7SjV:itQHF+B+D6goKh+w0jEx+/GjV	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	4.18 KB	MD5: 51e899b4b16ffba7bcf67e57a433d60a SHA1: b5d381f81f3c24918152cbe66e11a17fd1aabc6d SHA256: b1d0d24ec855ea1dfcaa05672758e34c7383b3cde5fc52e5c241b24fcb1ca209 SSDeep: 96:fGMg7Cm/CGI0fEhXtutZPALGK/829dsKY+AxHvkkPg:fGMg7C2ZISfoLGK/829Xg9LY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.83 KB	MD5: 12430a97838d1d2bed5e0f32c3f7d964 SHA1: 58cbb2e91edc0c4377becc38ac12113001f8b941 SHA256: e9467235f1808adb24801b0d3f8f164d974c57da08907ed86d25aaa6df2a1c6e SSDeep: 96:b1VLZDPjdCyYM1a3gdB5mIhyHvDHPY/Woef+kPg:b1VLhjdBYzu7AHv8EhY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	79.10 KB	MD5: 309f5bb1d429494945b03060b0f9f5fc SHA1: 79946f3fdd0d6fbac42eb9d06840870b84935222 SHA256: f00dc085d1f65d53f7f1c84748772dcdf3c1e3c5c6d790ac6bbcbc97aee08559 SSDeep: 1536:epNdhqptftr0iQ9eTlLE8Lb2aVHwK27oB8OzdNFW9:qDhAtFr9Qe7i+R27DOJN4	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	53.41 KB	MD5: 2ccf3f5fbc05a52961547a6a2aa136e0 SHA1: c4523aeed616f1507419b518a463eca1d0eff6f7 SHA256: 79455324bb93bc481e289d018271d160c6412b2d940690a6098b378cdc3b5ee6 SSDeep: 1536:jMc1GEbkZdkvJq5cFZNFcicDdJx76FBX/XEn:wcUQAdt+Y6PMn	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	80.69 KB	MD5: 108487f6e7c140d071a8814fbff966f8 SHA1: e5c2856942b1d06d2baf7e2bf9ae35827ab6875b SHA256: 5771b0b8716b408fe37b5c4de8b91e4d89d73db4ad815e2813b94274748bb4fe SSDeep: 1536:kIaj/MCfb4bQ1Wkp+B3rpytgPKFFLekomnDepz2x+BAdeJc:3arxb4boWkQeOifekoEDepf1S	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	4.00 KB	MD5: dc546beb6d3bab1a91a779ed04d07e2b SHA1: e66bfe5f675ce27a6b555b00705b63ecae21aa17 SHA256: c5a3be348fe4db92e3b928db77786527bf90a3694bdaf4bcf6c3b13d13184f2c SSDeep: 96:9mujV/XKrFHcQ+ioDme6YduckSVtc12+FSTR4H1gniThPOujKmxkPg:8ujV/KJOiQLdsSXRGencmujKhY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	76.12 KB	MD5: 478ad1be4c67237e9566263d1e79e325 SHA1: 653fbbf72a03ad0b5504bb0a8b4c125fe6abb6f5 SHA256: 94c16061a2e8f2685d0f47a11b7f3a9323cd5ed59fb10e61732de5f7d605715c SSDeep: 1536:F2vfW6CWsnaJPFI67sz/1zRjLAYlXe6f4xD2ElkJVt4LzYDpT8uRCfvdXo/lHDI:0WH7a9SXLO6gQE4tszmCf0lHk	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	77.69 KB	MD5: 8225a6c564ea46d5ba3a75b9fd500b2c SHA1: c394fcc4752184dcc0661ddc344baf383b9e29ce SHA256: 3fbe28f6cd3fbbde826b262bca9ba44b47bc5900f6075d1e81b2052e8f6db615 SSDeep: 1536:al4GG4Iwa6lz8js5BzDI1So+aA8Z1QIsyGP/lcJ01IQkoZcRezEKM:KZMVsT81gaAY5SP/6J7oUezjM	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	75.27 KB	MD5: c78a4a401acffef7870d429454fb9c9c SHA1: 660f2d2ef541be198b542cb4e7abc6982ab6bbd6 SHA256: 69f25e5b4d34ace4f8b1742bf1b2911ddce0e3c286138b4bb722a11325c9707b SSDeep: 1536:8/lZsBvK97xyan4XumOqokxq5VmGisCPdf66TmIB79:8/l444bokxIVhijdCe579	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	5.93 KB	MD5: 45890b0e6a0c0f5b966a2a76f0a15574 SHA1: b0b2c94f347d95948be6265a4a9bc089f3465925 SHA256: 01916d56be0484a311239213075b6591e4412ff3623d042f56b13089c03a4eae SSDeep: 96:2ZYnUgeHct5X9Xln/m1gbtB/pDo/DZHKb51bhGyf1fAHKb913bpou7q5ed4kPg:QYnxl5XJt3/pE14bhGUZ4Kx13bpp7qE2	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.21 KB	MD5: 2fcf9acbbd094351a4e774c444928c11 SHA1: 7c785958dad115a988f2e08e80b0b80e4238cb0f SHA256: bbff2ea563490fd248951c682f307d1831093df80a7ccc43e000d2e451f3aefa SSDeep: 96:aMVOpn7iUnygdq0W9wsZsCqaT6t2PSTOuJjQMvvkPg:tspn7ikygdqb9pNlTo2avUVY	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	4.14 KB	MD5: 80f68f8724139ccdc35355bd0ac4f99f SHA1: e33d9a283aba5d4384c09632572b0a22aee6b28b SHA256: 2433393e71bea23bcf5f2254c917f967a059337d62bde6829bd9f43259007f71 SSDeep: 96:RHE3LK53HqADNhnB1jNBGuThmbm0fjTGXEZFm93zTfpkPg:RHE7K5JDNhxMrPLm93yY	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	78.62 KB	MD5: c903d673ef7895148ebb7529b352afa3 SHA1: 2d9313e722e6c72d7b148d178280b9dfe8391aa8 SHA256: c980533030d8c7453f9edfa660654686d6c45a6c087d7446dbec2960cabea5c7 SSDeep: 1536:wvMJZqCZRNppl7ZXItF1r6rN6N97IiYD8KjTR4G3pHHtvR:y0zp5mvr6rIDIiYDDjLdn	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	6.39 KB	MD5: d69259ee7142c5d67beffc9cbc21031b SHA1: 0a705118cd53b7e211aa444508ce40f62f241597 SHA256: 4ea29f8412f29b5d064f3e9c02d59400f46b9bea992d48d204315b7a12137d7a SSDeep: 192:66oejlYxra31tp7216qpTL7l4dUJGC9nQggQh7hm0tNY:6teB02js5jG0nQg3hhPk	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.35 KB	MD5: 790b6afe18b9b7f8f1d564c4452e3467 SHA1: 8033fd3ee6cf45421a052f93da93118abdfef169 SHA256: c25b3d4b90c30f9b6bc0ec5bcc384c43208592844592c138bebeb46ac296fb2e SSDeep: 24:uVyn1Erd3UFYjKfdL8zDRQt8QBpWTBuCPJVIptEBhUv44FhEGWzhlpThW4MRn:uYiJkFYjWdL85NzMOktELUv4KWzhlpI1	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.36 KB	MD5: 4c8717c1fdce40517b6eef5f1ba5f23b SHA1: a85e2da4f7d3f3cccf94e7c417e87824fe4e750f SHA256: 9521f3039d68d4bb03182fccbbdcb580bf7e73c65c62cb61c1282841f9ba9ca0 SSDeep: 24:/RLpu+aJOSDbQCRwyPKHp4JjEPZ4Ry/uviEEGmm4hgFCAT5W4M/:/RLfaJ9DbByyPa64By7viEEGxIsQ4s	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	59.65 KB	MD5: 7aee9ad97bf92c2bda61eeb838c5757a SHA1: 71067562a101325ddb919ba88f90620485d08271 SHA256: bf284252efb609456cb1b7c20bec4b5bb9003d8b0d7887f45871229de41bcf92 SSDeep: 768:2dn0twPGISsvIxRbfRKPBAD+AbryF4YQVJv0x6xN0bFsl4SXJFA57L/jdzckI0XJ:2diSGLuIPLzGlQPq6xahsld8LtHVS2/	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	3.22 KB	MD5: 1703773c78b769fcca061db896818164 SHA1: 596eeea71a2f3557a4526d75ed402b72315ad60e SHA256: 1526fa08176389c68358d62dc2ec3cba6311f805f5a3dff91943140454b96a27 SSDeep: 48:zRBWGTqOeK1YAW0KvssCOdd+0wW3Jh73QBaVSMCRmX+m7rWzECaMWkPboZ:zRMGTqOe3ZfCOSg5tIFRmRegQWkPg	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	78.37 KB	MD5: dd710c860ef70b42647451e704f89312 SHA1: 0ac20751b402ef18a09fc6d578aaf2d43784cb81 SHA256: d9dd146aaf9fed34f16687168eb920aa91e1b2fc386d10134f33f3ba62424fd4 SSDeep: 1536:0lRg+hDKJVOGMcz3N57Cm19iIF1T/GIadQPWshzHMAp4eYl2zvW/:0lS+hEVOyz3N5uAwY7ad0SR/	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	59.51 KB	MD5: 46b21e91b5b42dddf46258e0633fe600 SHA1: 9f28bff5b6b7bc5880462f88ed670e9d47fd7447 SHA256: 56140fbf5da550cd88282e1768054fedfdd76374861bde6f58d6a9a7bca48667 SSDeep: 1536:wPp+uLZ/mEKCaEgkrL9jJKqV5o+Dp9SP6QVvf:whvKBk9NjV5wVvf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	4.00 KB	MD5: a638dd55eb16f91186906185df516a7f SHA1: 845c08d3e8257cb2849be89bebed073353ad737c SHA256: c1af85243baceb68cfaecd2b7b16f14bdfdd8b8f059a15800446cdc1aa476833 SSDeep: 96:ruhvc/51o3OC9XtS/PGYrdxzsYpqfKAZUgpUi8OnkPg:XXMOC9XtS/uYrdxQOPgpCvY	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[decryptyourdata@qq.com].bat	15.99 KB	MD5: ce8eb22a2542d4c5e9cde31d12c686f0 SHA1: 98308f34f007b9b5be0d9f19c07a06950262a0c3 SHA256: 7d63852490a2455c76beba4fb770a9dffe860ffd052351749e709858c7e533a1 SSDeep: 384:MkeTDOwWJF3qOXpm8CcNblatmuZ9CN4ErufBj:Z7wW73v9bQmuIFCj	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	79.82 KB	MD5: b52f199a8d05f3b9efba7e1643acb392 SHA1: 3d85dc2f3d8e9e2929026655a827a0bd459a150c SHA256: 4da01d2bccb537f8ab3b8a93067392d9be6c2d0d669915a15872e83c9c2f2d58 SSDeep: 1536:93Ny+NwNvk5ZxmQoqUf3HXCKDZznt9sca5hm5eXhvNJC7aKJT5iWLYl+czSNwral:kNMKNXC6JnbaXm5eXfCjJNiWLm3zawru	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	91.38 KB	MD5: 80f70a0f9be02e84653cc94637f7988e SHA1: 8ac7f65d019eb439f2c6dc08558565b1f91778fc SHA256: e960b5515067f9bf209a7a1c6f9433693bdec666f0b48e8792be279075c47605 SSDeep: 1536:kBgGfwAqMob/Bypq4kxihVvoeNY7s1vk/lFV7p/bMUQ+MhxdQ/Ps7jiU6eCbaKoY:k/fwXb/YpVv7+g1c/l7BbFShxdQXOjiH	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	38.37 KB	MD5: eea77f5404dc7c3a20d760aa741bc77a SHA1: e1d04afd17e5eced29e0f45dc0e282201c3b759b SHA256: 33ca56399baf16e511e730fc1fb6325008cfbe7ae9e506beda80dacf5d349f7a SSDeep: 768:MgF5TjfqS6NlYHrFQrB4xCCCIfImUJrRrGgkGdlgMIRd7U:Mg/fqjNlYHW941ImUJUudeMIRd7U	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[decryptyourdata@qq.com].bat	1.36 KB	MD5: b5f3dc02461dc0696a507294804aa84d SHA1: b620cea34a20de2848f1c339ba96b3d06f84a5d3 SHA256: c57e021937ab447a1368432d874bda5869f1042d554c941c570788ce14022224 SSDeep: 24:duen9nSF8Sr0Nm3A2z+kCEsAh9sF651G9e2A7Z6bbgRTHopPyW4MB:YS9nSFBr00QZkCEPsF651G98FabgxHer	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[decryptyourdata@qq.com].bat	10.13 KB	MD5: beadc08843f3c7432450ae7058d2f5ad SHA1: c5eb367894c386d82a50832ce5e45e59e0e1672c SHA256: 7847347db48e35e02207bb21a0f754c66e9994f0b207fc96023f6834c60743fd SSDeep: 192:LKf8xztLwrBqO/P+tzuxqAiVij6N1s56BHWQnQg4B1QY50MT/zi:LKUxziqgiViws56B0BDlzzi	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[decryptyourdata@qq.com].bat	36.08 KB	MD5: 297ce3002571de0bd82f6064f270f195 SHA1: 2f4d1542aa1a3f3adba7b4950cceb0cc33a11a53 SHA256: c23cf5ee6673381979a026bd2c162b4aba0f40214d0e3dc602eef1498dcd739a SSDeep: 768:ADn8zNKl6LVG/M0VQ6lvhXH+7p7PmpASUM87FYiwdGh:y8pKcI5i6VlHUSeSS+i5	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	38.37 KB	MD5: fbfd8c9860c9ff9a343ba4299bac0ae9 SHA1: a97e4cf1a3834de50a590afe0f4026018eb34170 SHA256: 860908e03ecb8c6fa17c0d5ac2410c291414f06c7f8ca1addd1ed315a1d27503 SSDeep: 768:1NWlCMggosyt8FtmJl2Cz8hAA/2kY/fYVAwdw9xnpscxYKjlSqpVAQv1DwTD:/WljTod8Il2CpTGAwibKKAqpmQtDyD	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	197.32 KB	MD5: 7f3258336c987fc446e9c0e596c149dc SHA1: c27b205c4baa6b10abc0fdbc53cf8d7195843f69 SHA256: 04253677ab2e47c5a324d2867e95cc7b6a1201e8a33107636df21d2a7e74be0d SSDeep: 6144:8YkhDj0BZy2MbENV3xFUuLF/Dj+X0b5ru4bJJUS2UAJ:8YkFcy2VNV3xWuJ/+Ebw41/IJ	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	265.91 KB	MD5: 8fef1d5d4d3e6640dc56640b465efb14 SHA1: 86a6882665845b68c9b90d58a756c03c069c0c34 SHA256: 91928f8a7e9b2436d58f7a20a5592ecaf642e780b9f2f508ebdaec174aa914b0 SSDeep: 6144:c9/Hd3NwhB19aXoE1JOv39s64MwbXmlT34tWZE7a:c9V3NOcbTyNs69umlTOC	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	2.56 MB	MD5: 82f72baabb0f09fb42b5de6ba402d7be SHA1: 95e431ca26b5f8521ec95f5176ba5904367ae1e5 SHA256: 46f43c4c25e2c66d776f85b72fa80c37dc82fc4760bce9934e296e1c94872eb4 SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGxBDCYGUr8VQv4FTQrrlAVcwRSIS5YO9UcZW:ncxisfQxoML8Vy4FE16cwRvSLBW	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[decryptyourdata@qq.com].bat	29.65 KB	MD5: 48a898fd3b33e1667b5293eaf92efd08 SHA1: b8683f964d59d4894b4789e6960b6f83a9e31680 SHA256: 8b792c825bebde2ec4941a2ff609897ea8341bd10de4f812816167f18666f43f SSDeep: 768:FhXpiOZYrhS/cT70nSKgz5jRlhSvLVF3h9F46:zXAik0nSKgdjRXuLJ9F46	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp.id-B4197730.[decryptyourdata@qq.com].bat	3.77 KB	MD5: c0b5e341dcbd2191d9352028904acf63 SHA1: 2e5cb8fe799a687d7f9e8fb2dde0a4dc3f068794 SHA256: 7bd8b0a5b74c6ff585014eaddd6b1925abbf31a8791a794a09a098943f0c471f SSDeep: 96:CjMTbSFb6z9GxIOV9vtFeCt/gZtI7ZxG+2/EfvVQGL0XfkPM:CjMfS6R6I69FY6GOfvVQGLXE	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml.id-B4197730.[decryptyourdata@qq.com].bat	13.99 KB	MD5: 94d97d0fce7dfec58b4c91451dcdaed8 SHA1: 6f41d86fa1ef46d1135805c98106db5a97c615cd SHA256: 759021dbcba703fdcbcbb62bff8a095ae42df90d03d47283a78ce70c43296453 SSDeep: 384:mKNquRm9jKk5GO53fR0SUj8b04pbAKAZD:mbblR09ja04ux	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	38.23 KB	MD5: 7bb493ee62af4bb28db8c25c59168992 SHA1: 47e59041a9bc49b8c208fbdbdad76c735bebcb26 SHA256: ef6474b40e8159885815e82706994b513492c1797ffcd46e8b85bdae37e61df9 SSDeep: 768:EfoeFpGHSdiEcyvxupOYc49L9Ra82XG335A1pyIrxy8V3GEZs+:E8ivMMYcGJ48+Gn5A1pFxyoRZD	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[decryptyourdata@qq.com].bat	173.83 MB	MD5: cc75e7bda8993fedfe1a6badcf08dce7 SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[decryptyourdata@qq.com].bat	40.36 KB	MD5: 15d1be69eb0391d11cc0997d93f3a142 SHA1: 71e58df679d5c010d472be192f8c346df80e323e SHA256: 80e6e74a17eb506d4fd05432705046ad5d0e2a67e37c4f72493517dea6c29389 SSDeep: 768:ZLFC+Ct6Xpqiz01TyLJQFcxyRSedHj5VFZAd8yicN5PJfyztEkaw+K1QsBgGWRyn:ZRCzYXpQc9QGxxOjvF6d8eN5ozt5RJ1b	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[decryptyourdata@qq.com].bat	101.87 KB	MD5: b1c076a180f74585f2d17588a4bc437e SHA1: 0f0d07c7a98318334945354d587d6ed1128b3730 SHA256: 424d112705aa2c45a69e6ecdd48d6dd09db7e93cc9090bbc4fa86dcb9fa584ea SSDeep: 3072:hpR58CWADPf4x2K7Q6fbsyPxrt55Eg3cjm3y0:R58CWIfqjUWVPxp4s13y0	... File Actions Show Properties Download
C:\Boot\BOOTSTAT.DAT.id-B4197730.[decryptyourdata@qq.com].bat	64.25 KB	MD5: 90cba9219e503e2306a609c536f4f82a SHA1: 7198da6cfbfb8db2ba7bec84fccab9b78ecfd246 SHA256: d57e281755e0cc90a8778965cf4d5f00b150ebcc4563f96d79919e9e30904c19 SSDeep: 1536:qD69CQnVudmPN7ydgxyegBdosfJTUuU7WuXc5:469CIucPN7ydogB+shPURc5	... File Actions Show Properties Download
C:\BOOTSECT.BAK.id-B4197730.[decryptyourdata@qq.com].bat	8.25 KB	MD5: a5b76683a5d071223a370ea410b7195d SHA1: 30af170e0db4163c2c477a91594772a74924cd12 SHA256: b1dfb943b7824319d3b75b8bf5f2530430b37eac62c82c31722ecb882e23494e SSDeep: 192:ZQCpFoJyp77mH+8riip3T7pWvQCaDdlZ2kPfZjrUcE1dFCaA:ZQK6JyppafEMDUEi0	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	4.62 KB	MD5: a580feb6bbb6f1faba1fb2eb624c93e3 SHA1: 311f85b3198d1f1eda61eabc1fd0bbe43185103c SHA256: 4d71e1d9f3f67c24482e7f692d831faf054d6da532582cb10f3dd3d73cbc62aa SSDeep: 96:nf8hWjUKIOA2La50VZFTQU7UgaFwXQ4EvNDXF3y0Fd2he3/piNjvukPs:n0hWBO2LaKFpRaFwA4EvNbdy0Fdsw0Nq	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[decryptyourdata@qq.com].bat	4.30 KB	MD5: 9fe02706182b10130d555406f2d4f7e1 SHA1: 9cbfbc8f2e39ea8da23c2a2c1708ec9cf4542f83 SHA256: af525f52bdac5c9a067f7b2db111ec68aa852066a139ee924ce15fd0fd10cd65 SSDeep: 96:9XCV2RNNGrZ14tyCaLvud0T+DEJyfRtPMDRL5rNdkP0:IV2HklqtyCaLvZT+DdfRtUDc8	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	4.93 KB	MD5: d6b9d13971b726f8cce475e138826b89 SHA1: 0ab6185a5170656668fa1298e95400cc55597c89 SHA256: f8a3d36512cee081792a2192573c726191798ca57a75f44fc24b9f2d502382a6 SSDeep: 96:ik2n+PH0QSnaUjtpzC+CAOa32mfRTFODQJM6+GZP5xo54Aehf4mzq5RSvQkPA:ik2+RUjtpzCox32U0QJPjP5xo54AedJE	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	1.11 MB	MD5: 385ad351af7376523f9e30c72da7d9df SHA1: f0e8141ec2f7f711be03435ecda68932a965f5ae SHA256: 8343c2e3f05eafe28d2403c94ceeae0b5d9b8b92c57cb800fd44f4dd35ee69b0 SSDeep: 24576:APTgkfLSXxR034kqHgxxPrbmveXJp8KT3LBWPzurmnN82tS8Ug3IYAhu1IGJQsRT:APTgkfLcxR031XlrRXA8G+mLSg3IV0z9	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	852.27 KB	MD5: 61ff8da5ee2b50f580071f4f89db0b67 SHA1: 70623f71ad5b854591025f9ec84530526059f71d SHA256: c07d52bbeeba794c9b9339847ae86b1f1336247f8926ae1370539c3be9aed816 SSDeep: 12288:79Nw6YoFXLi9r0QdzgGMt8xTp4DNbjQFcf1nb6f0nAORdsXm:HhwdzBQ85psQFctb6fV+dsXm	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	180.75 KB	MD5: 08bb5c19bda5d6eddc55f738f47e8f14 SHA1: 4b59e5877cb6a636aaf80e1afc678cea83aeefe3 SHA256: 2acaeee4918b1b9ebdd23d1893a320fb9ac463d06c8dd5c4b7bdb8728aa85581 SSDeep: 3072:dO4n59CCSF3c/ywTLKUCgQr89NqCSegOHkoqr8x+LIDWInA4Kz7Unoloy:RjCZFiPCgQocxefSQmnSMoy	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	484.27 KB	MD5: 220ae967217130fbeba8d568a0f178e9 SHA1: 313f299dd97ccfd722de6aeb4c3d3cbc5a2bb9e2 SHA256: 9f472af1072b6e7bb70a7c767d7258bd530dfde990f55666f606ccc3b594b3e5 SSDeep: 12288:LRZsBOHew6Cl9cqC9t1pYKDatCvPWPXtM/v4ikmxm9:FMLZ09cqgt1iMEkPP5kmxY	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	92.75 KB	MD5: 7d936638c8cb16cd7d6b530f62791d93 SHA1: 0d337523ed80fc7bcee67d8d2762bba798e81cbc SHA256: b97ffea26983aad49dea57715c417365effc5985ad4a527fec44347f10863682 SSDeep: 1536:D66y3zXW9sM+PRQjJKfh5/jwFO/ar37fHHYTA5Zc7MEmqmY1gZffXsdWEM/gVNxy:D7y3zXWEpQd2Ljwwar3rJfc7rmqmH3YS	... File Actions Show Properties Download
C:\588bce7c90097ed212\Setup.exe.id-B4197730.[decryptyourdata@qq.com].bat	76.55 KB	MD5: 232628466fe231224a857baae5501dc5 SHA1: cdd741c3defc2824121a4aa17f2a172a8db35393 SHA256: 4012e53b4654553264246960ec5543755b0cbfd286b133584c659da460b02852 SSDeep: 1536:c2c4kYUQOvychIIHs/RbDW7cVUV2/UOH0t5ka0a8Ywa8CT9CaHd:3TkYUQO6wpKRXW7B2/eL10a8YwxAb9	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[decryptyourdata@qq.com].bat	788.58 KB	MD5: 008c9714eae8abe424132252e5878e6a SHA1: 5d5297c36c61d9454bef924209b8849138cd2250 SHA256: 412a4db75db2a5557fa7993d9ed1cc1d852b0a8a029f9d00c248daa259ae8807 SSDeep: 24576:4FA86cwHIZltaHR/+QZJ78Ssj/1V2X3tZl8:6V4IbQTyj/14X3tZy	... File Actions Show Properties Download
C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[decryptyourdata@qq.com].bat	141.27 KB	MD5: 3f117afc5739f3e789ed802f303461ed SHA1: 063fcfcb7e6dda6fc211fe25582d12f83a68eb26 SHA256: 98f5cbf821a77315366fc5c8b49bb3e505b581423b138783c4ec2974a3c44ca7 SSDeep: 3072:KhB3GvDstdaja7fzey3oC4veNcdhRM7CLHW0AyMlCLsMu8b5MFihAA9:4B2v4tca7ey3xFehSY2Ys5EMFiiA9	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[decryptyourdata@qq.com].bat	94.08 KB	MD5: 934ac216076ab65e996b37522351954f SHA1: 41bca37e25921ad55fdf709e7a0152a6762a6efb SHA256: e3c9d3d6df8bd2b0159aec22ae506afefcd1c3047009063efa6944e899cd9660 SSDeep: 1536:+qNM802AUEPONAz0ftsTX4ZURblCaokFgeOZ3VwOfI/0Y59nNc4clGN:+QO26POPVsTXUUL71geCVw5fc4clGN	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[decryptyourdata@qq.com].bat	288.57 KB	MD5: ba6b62472eb6e63b1aabd653198ed31a SHA1: ef1c281c4bcb0f0708c42932dc08f47604927f7f SHA256: e0a503f89afda6ee78651e5aa0681c3341cfbbf41dfe74577feed6c932d94a5c SSDeep: 6144:kv44ZuRZZswfC6JlXXJO/wHlOfWcD0XyhZOXQWOrDUbGgRY:kvzZuR9C6TXJO/wH8f/D0ihZOX3OrDUE	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	5.71 MB	MD5: 0458695ee8a6976b27aff57ecd9009de SHA1: 565198ed841e04ee7a9c4e094d6f7294ce55a4ab SHA256: f7a80466dbbf3ef6b58a63e73115303372348cb72ccaf2d1fca9cb47244f5f81 SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKNc3zl:e3PBkOK2Knq45mY4H5OMKkKNax	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	2.84 MB	MD5: f67593a892532dd6248bd984119e0f46 SHA1: 8473f60cd24f20b632965755b2afe2c6c3e48983 SHA256: f73db5501155641b03992041b49c5adf21c12459a40fe0f6d4400055bba6966e SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIKS26g7Z2YYzha:WV4Yab1PAdXZzKUYxs3pKZnK36g7wYn	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	890 bytes	MD5: e9183e35966b2a828d4c7138a0f19c8f SHA1: c925271ae4fe743755a52f1b2613d1e8bc300f9c SHA256: f3ba1c551d586aea291e46ac0e75df256f14e1493612cc1914f5b3b1680b6d76 SSDeep: 24:DwIgXzdEhAFeY1ECthbqH2tsKgE9HB0pFX2ehTH0kPbQ4ir:8dXBHD0CsKfGzUkPbor	... File Actions Show Properties Download
C:\Program Files\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	410 bytes	MD5: e30d0f435d1f8466dbee28be0a6583bd SHA1: 72ee489a82007aa983fb1f52c75a0c5f40c8d10a SHA256: 9c24fbfa8cf6b594049f6bff9456fdd44a926bd5a106a6a75786bc442a284728 SSDeep: 12:GJtD6YHbMSD0QNxxTuUkEub5kwxQb2viae:etNMDQpTPkPbQ4ir	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[decryptyourdata@qq.com].bat	1.62 KB	MD5: 0e656831b7018017f9b88fd5b215ddc1 SHA1: 3ea770ed40bb5280a7c567c3db8235e4c3bd6106 SHA256: 38bf3f806ef6ad7b1164ea1563aa99614a228ccdad2bbecd6f60b6a72457b847 SSDeep: 48:kt4dTg5MB7h2KIdt9i36dQdDHBGOxGR4zabVhiy1UdvEdkPboF:G4pg5S2KCt99KBIkaJo1dvEdkPM	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[decryptyourdata@qq.com].bat	15.15 KB	MD5: 22892bd1fcb68394b0d931bcb90d9183 SHA1: e0f76d930e1f62297eaf5068e630dc91c4d86d84 SHA256: 22e31bbd370440098467c27f656ac31059d0f5e79bee0e9c99cf383dca09d09b SSDeep: 384:YzUQ0++Ge8kJOWNM9QKqOWaWlxS8OwSUYnw96/mNetp6:aqGPmOLTqvqEYnA6/mMtp6	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[decryptyourdata@qq.com].bat	14.06 KB	MD5: c4ad39989f09c36ec4d29b40f7e9cab0 SHA1: 56f92801b63ae311d32b84895c4cb8a3b8fbbed5 SHA256: 487b55f7644eaf892b306f456199442d023b36055b5c577eef75b363df8109d7 SSDeep: 384:AGVtKM37WvXS09UZdpfZ0flW7mVeJ0R6DLz97:8M7iXFCTpyNK0REt	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[decryptyourdata@qq.com].bat	8.62 KB	MD5: cebee0c595c60b433535809cdae5bfaa SHA1: 6db8eda2f4f578b1a42a774f431818f49a36aaa3 SHA256: a47670108a66034cbc9980158971487eb5487fb060c96bc1e6bce2656f0a01dd SSDeep: 192:PH+LraJmgRmTvcdIDcoLcOroQUUyssl/WUWN0eWnYPE:PH+p8OCIDNJUplFeiH	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	7.87 KB	MD5: 889df36e1a798c48f2bccb226a62ebf7 SHA1: a21b00ea07fdea5d4c93a6a363e5a803d4b842c9 SHA256: b283ddcc6f1be1888e4ee1f928b37bc2e92d52f1ef0b6c67dc03cd794aaa2868 SSDeep: 192:cmfQ+2F4V4RBrnfrZnRHfXHEVmITafX1A0QjeeAtq:cmfQZ021frBR/0NTwlzQSen	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	404 bytes	MD5: b12e0bf2d7b3ec1f4f90fac7e88ee081 SHA1: dc28fe62ea31f543822565cf62cfeded2f32bbfa SHA256: 0ed7791c6bbb9bb1875b6016fda7afa46d8d23f4cd70e576e2ddccaf498eaebf SSDeep: 12:RDBVra9Z15acQFxRMfFTuHYkEub5kwxQb2viag:RDBSZ15acixGtTnkPbQ4ip	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	12.21 KB	MD5: 9ad82a7baef8c047a528d36f457f1662 SHA1: 2e3e7dd0f7c3efb2b5e242b73015d7e157c5d2f6 SHA256: 7c217218c37fae0b8e23a81e2c9433f545bb4877270796438d43bf5cfa6e56d7 SSDeep: 192:vZd4cT9rys7rOIsCwZ9AU/kw1mfH8fbZwlMJG4lLfHHXtUHb4CLwhsKlQ:RFjnRsJZj/31vWMfkyhsJ	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	434 bytes	MD5: 58e432094d9549903c907d63756ed501 SHA1: 92bcadf120536b386c82fa6b788654c54f707dab SHA256: d0bef5845fb4bae57fc071fdaf790665e054502fbdd9da5bfe5561d1575fec8a SSDeep: 12:zgI6Du4rcGIdHEZtuZ3OFTuANSkEub5kwxQb2viayt:zgdDPAzHO3TjQkPbQ4ij	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	422 bytes	MD5: 06555bc6a2d593b60ebf21d155611541 SHA1: 6837287ed122097c668f22854ec8cb29f3c91f9a SHA256: 3fc2fa5c3e48339ec12c0f3d2f541def06d8fb25d6cf43a48120372076e662d8 SSDeep: 12:iGguKkjTLUtzYZdvICeSLq3H5FTueB8HkEub5kwxQb2via2t:iGgEjT4tzEdvI5mgrTnmHkPbQ4iNt	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	5.61 MB	MD5: e8ad98e1a2e100d64d9d9d7fe6a6c508 SHA1: 162c5e21bdaf7e256d86158588b0fd5aad06677d SHA256: 02430c1c17cca9700aa94f1a42d92f87e0b1821e07537fe78bff1e93cb0d482a SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKboHmOKhV0s:27GBHTK8KXZ4UuY1kB1iKFKboHmOKn0s	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	422 bytes	MD5: 2acbfc5c2caeb3b1c595a2285f45edec SHA1: 312199f623928d4a3c19523078eb9e75f7608e00 SHA256: a600e2fa7d72f227d5a955ccdfe885102f20b9b3369b1fc724f53e0fe8d56cd3 SSDeep: 12:CQXwQlLj8C6TCKEq30b5FTu7kEub5kwxQb2via2t:CQXw0LbONE3rTckPbQ4iNt	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	422 bytes	MD5: 18bf11e45265e1f4f23693202771e196 SHA1: 26a3d6c09330c5ca7e617ee9ce4443e3be24bd11 SHA256: ffa0eabf6ce38bcb1d30b1a2ca7a22f68c7f994517c1ea7acd957eed18799137 SSDeep: 12:j1meah7+3SGQM98a3vT5FTuKvWHkEub5kwxQb2via2t:JvMi3SGT988rTHvWHkPbQ4iNt	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[decryptyourdata@qq.com].bat	4.37 KB	MD5: c3d149adeb75185430368c44eaae69d1 SHA1: 12a6ec00dc4d9f4f1d2f2c6c5f837de1f55867e5 SHA256: 9a4f723f49721ee136f1fda6ea7d1fb636fa63d312525d431b65281e1f89a1af SSDeep: 96:nsrNVsv8y6sN0vS+kmNztqJsoCZ8QKiImnkP6:srNV3y2vS+kmPqJso0zPkC	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	418 bytes	MD5: eb7daf8ba499b69be70fbcfd20834278 SHA1: ef65096331e367d9260ecef94db04177ca35666d SHA256: a0971a8ec5173f481e8740b98b7822652c9288702ad120bee39647b5afd662cc SSDeep: 12:yOD/f2ixuVCCs3qFTuF2gkEub5kwxQb2viayt:yOr+ixO1TmxkPbQ4ij	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[decryptyourdata@qq.com].bat	280 bytes	MD5: 752d43b850748abc02f29b08e06b084c SHA1: f780397d66df6e4b447a5e7ef8bb091df36eb20c SHA256: 957e915f97a43712f5b49a7de031f494f617df00e1e8d8ae2efe2bd0d5c912e3 SSDeep: 6:gZRL1W7TpprYToLaG89ukEubyK1uwxQmk2vpMzuL4:WRpeETuVkEub5kwxQb2viac	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[decryptyourdata@qq.com].bat	103.25 KB	MD5: 95e8b078493f1796424a45c60bbbf707 SHA1: 4b8d133daddb7465a64106802c10d0e535b11675 SHA256: bb824fa1a06c630e7b709df1dc621fa605ea87e62a53e66b3412f0e837308c91 SSDeep: 1536:tenMo9QDOoEvOylh7LT/DTl4Ccq1NS0jVU9J6rR2t3cEPkYCXWsuf/4MJ:0Mo9mLMOy7Dyq7SUuGF2zP4GssH	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[decryptyourdata@qq.com].bat	62.71 KB	MD5: 60e2a6638d87fe979130d83b46f2ae96 SHA1: 2d2c2b540f81786c98f68b474d52b3958d79f2b1 SHA256: 62f385fc43cab2e2a1d2ce92d15eafe6403280f0b051ef3f18ad20201c273902 SSDeep: 1536:B26FICfPEcFbAGlxarEQ1yboE9+vnXxiBs:4EbFbAGf4hE9+vXss	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[decryptyourdata@qq.com].bat	1.17 KB	MD5: b42538dd65fc9797513dfa51c9a54aee SHA1: 2b29722360db993e30450a9efc59571ede12b7ec SHA256: 57805faa4c1a6bf1a55f460eb61e0668b509f60fca2ee2b3d944d00f0928360f SSDeep: 24:HAoZ1O+SrKnJcTccA8DYQliGHx9qR3RYn5Ex1QGTTVkPbQ4iB:VOyVcbD9l5oR3Jx1QeTVkPboB	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	434 bytes	MD5: 4f13760f37798282ce330b5f46888c97 SHA1: e115b41502a212eca5af88e1e7be57536f7328ae SHA256: 83f88b84dcc19efe44eb8c3020bac800a6d257a76e979cfeb092ca22c8838903 SSDeep: 12:XD1sjGPo6TDmPeVAqU30aFTuOHkEub5kwxQb2viayt:pLoCfVAqmTjkPbQ4ij	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	2.79 MB	MD5: fd4f3565c8816d261978c8402a500837 SHA1: 786b49be42d9761e8decdcf7b1822eca2b7c6ef9 SHA256: 5a70718544e276f6c860273dbc94e210b161307c4079c864585cdae0dc901ffe SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKh4DZ/KM4IRnCdX:oJbGnRau84KUYcs31KfFKhsZCMdRCN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[decryptyourdata@qq.com].bat	544 bytes	MD5: 10f707b067598af7188897c587c31de3 SHA1: ade64e6531bb312b3bcdc735bae2ac8c9cde8885 SHA256: 981a1ef6f17c979f1ee965748aac14211d6140db242a2f9081e36ae507e0d07a SSDeep: 12:ZHed7sIKbd7VdzzIB3aWWDp9jSV7mQlVjc1jIRMTuGpkEub5kwxQb2viak:Ad7s3Jba7R0kmTRkPbQ4i9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[decryptyourdata@qq.com].bat	6.42 MB	MD5: f5cd40f87982d1476336f37ac87de489 SHA1: aaa75ba65cf4d8ad106ab3dddb1f5fc4783294be SHA256: fc16e394b9d1dc75a4e46090ca05f9e94ad2bfcf2e1ab555669c8bc634154f2e SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNSK:5qk3NIX3NIIaiSi5I3itPd8tl5fiWqk5	... File Actions Show Properties Download
C:\BOOTNXT.id-B4197730.[decryptyourdata@qq.com].bat	242 bytes	MD5: 18e49f3e98d3828d7412935189679edb SHA1: f8a6237a2bb26486f70a69013d84c20050c29240 SHA256: f2c731032e7c073b08e845a4c5cc0e1e002ac332e78335f780bb25a81c9782c3 SSDeep: 6:hPlIToL3hAzXy4uhfyauL9qDPRUKdjAWU:hNITu3hIEra4Ny7	... File Actions Show Properties Download
C:\Logs\Application.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.25 KB	MD5: 91a525196ae7cb524a1d98be8dace890 SHA1: a948782028732e7b919b599a83ae9009942f3fc0 SHA256: 1d16007d653803526b9d876037d1ca4bdd6afc9808c8edad03b2ab12a21d7aa8 SSDeep: 1536:tWQ3tfQvrq6wdB34Y8tMHEDnh2XdpXuXvssLN2vSIuL9vUlqcEVlg3:YotfQvrqrB80uet1uJ8EV6	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[decryptyourdata@qq.com].bat	142.04 KB	MD5: da965e5d616bee9de99fea4ad1b7e61b SHA1: aafa4c1159eb397b39e5c915e93bca2f4ecff1d0 SHA256: 68e0153257304165f3fe7a835cde2f90eb8a405eb4afce11bb4b722b79d9357c SSDeep: 3072:KA1JVFDM1N8zsEkH//u7D6C6zKdGQ8gd7U:KIk1N/X/un6nzMj8ga	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.27 KB	MD5: 4e4b85ad6283476c5f3072b484aaaef5 SHA1: 5a1729a8ea3af07419a3ad831a06edf9fe05a453 SHA256: a41860ea45cf0d19e4d4736fc524166301cebca0ee5d23de149f2458e9a6c964 SSDeep: 1536:eeuwyjGWxLRF6RhoNBnpmsITt1BcxiodBqbEIFo37Jz4SMOB:eeuwyVx1RUsIJWFdaVSm+B	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.26 KB	MD5: 660537646ece032d06b00a93c902ead1 SHA1: 2849310733ec265376acd9e5b5896d1a7b355d67 SHA256: f5f97a6eda3835b90a5c144abd6ea27987951e3447589f4ede3d4b479e9cdc37 SSDeep: 1536:RM4c5IGoIj1iPFVi2yGI6dBJiS7mPxjSHGCmWtNCTP+Ju7GlCbLgSjy1+DeoT:Rdc5HjAPFxU62GHGBWtwTP+Ju7/4oXa8	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.28 KB	MD5: d2d3337dd03ff76c4d968bcd3438f3b8 SHA1: 9aaff404c3b6ed9847226298d453e69a3d44c1b2 SHA256: eb7996cb7c17d1a40c388e335284efad6c836db819ee569ba37067e52455a78e SSDeep: 1536:9/2mSr38t01RGlmrwWfZQhYgYh+RCPHPX7es9lt1o7kAs8PfcADo1:91Sr386rrwWfZQJYh+OHPLeMt1o77nfM	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 3c29c6f45e6f1d1b439a747cd820f99d SHA1: 8a333d271494eaafdf0726b2a4da45411b62e374 SHA256: 5d6f5cb53faea7b5bac859184171d24fdca0b37557b253cc3ef0ff81ecd287ca SSDeep: 1536:m3tRjqfXpgUbLp+Y6uw9+fAU1LnC35e0qG1/X15aSp1la+IFR:Y0pgU3DK9+IPJBqG1d5lfw+IFR	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.38 KB	MD5: cb787ed50a57c2b570f849304739602c SHA1: b1b1e43302d6bcf8f4c3e37d03ba46253d9b9c90 SHA256: f41058d712a8427fa2c0e451da4a234df3f23e3c253e68428da869d5de7bb590 SSDeep: 1536:93V6kDfac2GY6gwmQIECEGNf3iBXu+QEQy+HOOVMZPyIYR4:xVTDfac2Z6ih3KeeaO64qBG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 2f93a5b1aabc2257b90cc92900391afc SHA1: 4759c55ae8ff23875f273428ca3753adf6b11ee4 SHA256: 8fa0fef6dcb42b11ede32fef1a2dd8f0ed8c1a1e77764cda9724c16e27026594 SSDeep: 1536:mtgVSl70e7fCsp271L64nYe4/nEG0KJTDyzoh:270mCM271Nne/JTezA	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: e6c0ea6f2020415d34fcc327f063d956 SHA1: e72bb67dd4244675b3d761e57b2c5d87e48a5005 SHA256: 3c49e7c3d29c058795688e6906ac51b6ebc9c53288a5162f7191338034a0a1e5 SSDeep: 1536:s0QFERNkqEwMxEyu+D1NIF9ks/alp0EbYU+o3Bz:ujw7aH+9ZsCo3Bz	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: cd6eed654bcab155102bb9c562e48f4c SHA1: 2fd631805bd00a15a15cfad61541f0a3fe09b99f SHA256: 0aadb248708f89e8379eec8e55d9599bf429eabf55573419a91606480b4c0c83 SSDeep: 1536:DGBTDIGcTmwT3UoE4Gyot+fuK9XlMBYFqxOHgVjMzicaS2g+4:8FcTmaE4+4f3lJFqjMzBaNgF	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 3b2c3458d46fe309b36aba3e98e5b740 SHA1: c75084f673823cebef392c4a53efc2de6a8564d4 SHA256: be9e6466220a198a1565dc5caacf337ac51cb30fe85d3986aa053e329dec9370 SSDeep: 1536:Qv3lgOYmlFh92rHC4eNdhQFk1rr0wkcmBgGUod4mNMTi0m:i2+lFhgrHC4e95PkchoCma/m	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	378.59 KB	MD5: f1f465917646d672626a049cde4b15b3 SHA1: aaec1deed8552d10dd64c586fc53b7108c77bea9 SHA256: 1bbac67e46fdb4c4b75e56c0aa9faca123b4b575298b5bb2b78940d8015fb535 SSDeep: 6144:VgRoIuLtt/fdhDnCgCD8mTsdLoRFs5pq4R1SZ7YMEVBPGxtLCfMzH1eH9VyhbRMp:VbIuplfdNCg0/OZy7XECyfIu9VInyhG8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[decryptyourdata@qq.com].bat	170.68 KB	MD5: 91b33218b6cada9af3668ee9b5cd3dcc SHA1: ceaf2c2ab2784ec8ba9fec0a83ceae82d3938a9b SHA256: 6df4e712f9bc5b522209511aeb6367ddcc80ecd1528b5ab0d9927ccf798e319b SSDeep: 3072:NOhYcu1ci1XE9IRCqukGwX1aWGaPgzP7zkAiCcYYJBKelIzC77maxn64P1oZv:0Yh15QZcX1JPgzPcFvVGefDl64aZv	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.81 KB	MD5: ddc7477e9a61bd8ee885e8978494885b SHA1: 114b6d4ec238499892fcca848a42c5537411afa7 SHA256: c1c081fd66723262c0db21223b0a942a8b2d377b27dbab46d5c4b0a6dccc67a0 SSDeep: 48:WAmEBmdSdFwn1TFJXAYRa/kms0wameYekPbon:wcmawhFFAYResUmeYekPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[decryptyourdata@qq.com].bat	35.73 KB	MD5: e7ac5402334f45f4920202e6b4e52682 SHA1: 08cc240ad54f59d36003a53b0df644404e090a4a SHA256: ecdc0f0bd25986b2d1d79ca4f52e4e0df8f1f83ba85825ba4d49e6e04af1d1ac SSDeep: 768:rtUccicoxOgVaWILf6unsLPv+BnzEa+8eekORGBUTtLXvEc/:Fc7wkXTqv2zEzbORGqTJT	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: a2631f35b6383ffd981ba8c51e8b9dd0 SHA1: d8e8694ffb376e287143ab9171359405648f814c SHA256: 7f531a50ca2241017e2eaef78ff8f75b42d396d25bcddb278cc7410c067e31bc SSDeep: 24:eh6NDIGly/xD3XxZ/ZAkMegdChigZI29Nteotz2VB2nQTI9kPbQ4iVt:eENhy/9RzNgdChLLeic6kPbon	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: 5df50e44d0f2bfb368df042258f11c45 SHA1: 424c4bd22541944f54007ab9029a6a2e0891de67 SHA256: 6f6a10deabeabb5b9af1c5b5d5262ebaf2c7a39399572962d237dfd0c31da6ec SSDeep: 24576:tsikEhiT6VgT5iUWEPtFCi51+DGQA0cSfYj/UouxR8bAoJqoZ:tsnm45wqtB51PitpHxuZ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 935d93c8fd00e09dd9ffa5bcd1170f4c SHA1: 3ee2bfbeaba78a4fe0e82adcbc474807191272e4 SHA256: 6c7e4a42ffe042e14b2efe7ca70a5ee551a7a23feaaae27554314da624f90058 SSDeep: 1536:Hk5PPjqSaxik4gC9mvpS+kGCBQfnhnzv2RHP6L:E5PbqHcx9LUCBQfhnD+PI	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 86761801b58a0914fde88d0bcbc7e238 SHA1: 50b3eb303714f3eb5b10c8cfadf5422e173739d8 SHA256: 2fb4ff6dafbc4cfec9b8ca2dd61249a3934cc0d92fadc5f649e23a66b35e4ee0 SSDeep: 1536:yLuXRnOMk4dIxW6prIkyqbYJW1mCa9YzJvpzWUxKlZgkO7w4yuL:y6XXJdkIk7Yma9YR88KkkbuL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 4e141fa5b3b607d0f0030e18dd2b9b18 SHA1: 4b111de26d3979abad72b6d8b487df92e11a8203 SHA256: 7a4efc77134484d4dca03a528181fd3d888598aa27e0cd8573c3fe9082edf787 SSDeep: 24:yasZfc5GyNlm6iA4SuZIQjR1DbtFyytaqggI58x5PJ5XNDXqTapkPbQ4iVt:Skgy/m6L4SujR1vtFyxqg0x54apkPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	248.09 KB	MD5: 745ebc83ced1ea8917f534a4c8331706 SHA1: 94c881213b1a41066410d305eb41cb05ca2c10c1 SHA256: e1a2459c1f7d05265f35d253a5536bce6442173fa67733684ba53c33c5313524 SSDeep: 6144:7q4BGhXR9UvHTJathG8BrCHncPKalnt42VhukPMF9MyTTYwj0jZ3FAHy4et:7qsGhXUPTiBrCHchfVhx0TYwYFAf8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.07 MB	MD5: 6348c00d566e32be339aab092e1ff8e3 SHA1: bd401302d9183e6d755b7150ad32cb127f1c96ac SHA256: 9f45b4c657235508ee19f06acc3ff555845f90078159dc4635a68af8fb93d5c4 SSDeep: 24576:IKWBZ8Wsecr6OTu7z8RevCA6x/QSUgBIEV3hup6Mkl7K0zcozn0l:q8W7c7K8R0CN8gtVxK6M+7KsPzn0l	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	782.42 KB	MD5: 4c31c4b986423da446f907d05e11eb32 SHA1: d91abc6b60e1e4c05ff3bbc8cdfeb08f1b310ae3 SHA256: 24691eb6492c6f972fc869c24163b07366a9baf41c29e62698b1d5e6d0696c93 SSDeep: 24576:8CO3cOi9cWmk8CCbAV1krdn77LpUBvkqkIpL61/gpT:8CO3cr9bCFQIZPpUlCIpe1/iT	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	485.20 KB	MD5: 6e90ee0b41b6589d34af0d3034926795 SHA1: c7d62c37f9929e6476f1bd7fd9ff4794b91daa1a SHA256: 5e64725eae9889374c0bd19042544207d6ea6a8d2779dfe1c3ec369aa6c3757a SSDeep: 12288:1ar6pvjDSB+ZfFAanQ4rXveSPG8OdH7urgplm2f9nrAAi+O:jnC+MH7zTZ8Zp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: e8f6d8fc4a4f58bdee00b21c2862abf1 SHA1: 9c9b2fdbbaf9c2bf98122b717e746d69d745c028 SHA256: 5510883329783ac831047c1b1412bb0ceba1c89b27833911734814b152e53016 SSDeep: 1536:mwNJsjHstB8TnPccFvtlUoNUCc9LfdWVRp8JCnpDC4IkqA3U:mWIsv8j5flUoc9jcVDL9FIkqyU	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	19.31 KB	MD5: 80afee49d3aeb34ca89a203553cdac73 SHA1: 601a953ab46bce80cd79450ef8e3fb798a4b08d0 SHA256: 05d0ddd3656721ddd7257e39116cfed37655458e0abd7b0badeca948878ba095 SSDeep: 384:3jrBPT4dj2DTa1WZOVQUdkztMnrBPOoTHn+dUOswepLAS54JaueF6J8CsgA:3Z0gKWZOVQU0tMBOoTndOWNR54cu2Tp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	745.79 KB	MD5: bbdb381fb95730ffef97c1c8720314d9 SHA1: 32319f8dbc6c30d7078b8d01f9b2868a15c144ac SHA256: 43e1f37f4eaed488404b1b36bd6a0da5a42c1e171f161e26b25395907c708b8f SSDeep: 12288:2UoUnYsmZtn/24A4nXNcrb+W2OWdr1LPxbmoyWLhfCw5nSHZmRedk0IvESjWhn:2UoU+ZR24A4n9zWk1LPxbwg5neZmR8ku	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.35 KB	MD5: aad63a541cf81b849a2edd938de95d76 SHA1: 58eb73688020b3eb8566c8be548e4d30d6c15058 SHA256: 6d7bf710a4b19ff88f6122cbe48ce4721d7b1b534e1559b2c263dcadfca40fff SSDeep: 1536:ZmE9OEJNg3K0i/HdnrNcnuAxWlLUjIBUzKgLlLH+U5dl:ZFjJC31UZNcnuAgeI45Ln/l	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 54894c04ff6f4dfe27b422e52f7b864f SHA1: 05fd8ae36aee6b65846ff2a753f8f90fc683931d SHA256: 27680d02fe86d5f1d456165e31b58955a8fcdb29d0192ea75df73b6c3045c6d1 SSDeep: 1536:M1lDIT65o06CVxgCagEvGsnUYPpOlKQuz8UHzQgTYWFG5Z7hyOJ:EDUv0dDSG6UYBOcQuq3yOJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 6118df0f6de8d424495b3fe32d49e74c SHA1: 11b90995893ea14b73288bec7285c8285d28b398 SHA256: c1be7d79f25d4381f58e5ac56fe7f4e8135a5c51827e7e0c7887e72df59c06be SSDeep: 1536:GSDZ6pN2h1Fs68w20NlgCRiM3i0NphtJBIJP0WH3P:GSZ6pshzLWbMSkvtDIOW3P	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 6abb415dde57913a992855c501f76177 SHA1: 9adc6484c5c1e26a7fb0d15d9dcf99bb45db46a3 SHA256: 4b1b9a1b2ca4071d66a6ac9c7e9d7172652bf25658690009e39f3d7d7ebc2a5e SSDeep: 1536:1TMA/YGhVRcQfCd20C6g9bdmAdRi4vZ1qeEp0BXBnjzYxGS5y+xBaY79C:htHTfCdfg1dBdRATAnWGcya9C	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[decryptyourdata@qq.com].bat	41.88 MB	MD5: b790da90d0c6c3db2d470430d72b0adf SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166 SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578 SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 65cadd1744278f6578dfecfce01740ce SHA1: d3d67fca826e8c5a5a53028308cafb6ee7b4941d SHA256: 37b3e479e5cd5dad308bd5ea060ebd1ad13fcb92097a344201e316f564383609 SSDeep: 1536:tG1d5NRAdhFjADRKgrxLcsxDPlp6xq2qKi7W0g6eJtV0oHvAv7g:0dpA1jWcqPDg6eJtVp87g	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.35 KB	MD5: 2f8e74e58fae86e6b5bd537b06656b93 SHA1: 523f8b132e570ded5fd751cd94e2bb38c7939c3e SHA256: f04dbabc0d61f45762bb2edfa89f835500f7fba63a1b05423b272d1afa114211 SSDeep: 1536:Rm2cMNF+XN+GbnFrXWs/RNFKZFrxC7cIWUTIq7dMv:RKMgVdmqRjqVxaIqiv	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	2.82 MB	MD5: bf9ace2ecabbacc4f3e626a6c4d4b3c1 SHA1: 8ad352284437086697f8dec9e0bfd796cef96dde SHA256: cc3606d4c88af82f5b65c0857a9ac3edc0210e932113a78fa022dcff77fa9238 SSDeep: 24576:AwCK189R6PKDGhWHfHkVRd1QZkRDJ+2DO:BpM6LueHHR3DO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: 49b0383b65102367f260655d859f3034 SHA1: 4438f6d251e88f2c706ae1dc39eb7dca4a30e3ec SHA256: d4d455da7075448f0a0f583957d32b0f9b64f6c56f8d0c0ab791b03b6033efd8 SSDeep: 24576:onH1DFt7NwjpUr+NAJEYtwC9wkSL6qkjtkuDX2aCwY/LmP:u1xw+r0c9NBS+tkubfCp/a	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 302475ca07d7f94916613d16c961b418 SHA1: 8740761468e0b76fe930e3f4dbc8205f0b7431ee SHA256: 05757fe3a586dbec7a994c0702a6182d6bba1ee8ac57e6203e1e2581b699e448 SSDeep: 1536:yxMTT/dM1cV7px3f2QNwtXTvKj59HVB4qbkif4mJMq4JkOisK:/TT/Qa7nPNeXTvKj59HrbkXmJm2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 46b997f67122b1de2b804eb426d369bd SHA1: 464b7eb0e5bdd46700bdc4f1b86e6b5eab8ba013 SHA256: 17591d39954550757880dbba912fa9b392740a0fe7b461c7e69e858dad399007 SSDeep: 48:sjy0eoWhGaxAOXRYMDTEtHqIJesfkPbon:sydoWTxZXSU9IIsfkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: ef2ff9d45e3beb7549ad99f94118d698 SHA1: 7f1b0e2a5bb5f607b2d229604dc62d4c48c47abe SHA256: 1878ef55324cffd725bdc14cebf134ae62b6459c6bac8c1b92a54ed5233edf31 SSDeep: 24:PtRNMKGPOwo7rty+/SXNVf84Toq/Tm+8HNFyivnZTkoNTeVv4fjasM9hbZYprgT2:rNOp+/i+dR+yXhOoNA4fg9oYskPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	2.42 KB	MD5: 25908325861c16e64fba5147ce743443 SHA1: 1d689338b4c668b04926586782e16d2f3e0919df SHA256: c8eb18a8650d73144c7c82decf6b4f99dd732fe7ecb6f72aab1b6579f4b2942f SSDeep: 48:PruuKf186AYzFUOE4vNQ9xas8ji90LPkPbon:Duu8RNJUO3ZeOLPkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	2.42 KB	MD5: c6a78e3d44fb7beafac95f02d8bfca11 SHA1: c2e4fb59bd524a3b4c624b58e8c6a491611a6243 SHA256: f04ca6ad590e59187964a87ac9c8ca2c43bbb93372d1c925737fe495f6842ef1 SSDeep: 48:7wMpa2dbTPIJc9oFD7MfMINTEYJ8KAUndBAJVFHDWJA/5FCpuEp/jk8p8kPbon:7VPbOc9oBMnNTEY2qEJf4AjCp0S8kPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	211.14 KB	MD5: 2dc9d44a24913ac3ba7bd63f2473c326 SHA1: 184eb28c8e08e1cafca881e87dd5ff80be524483 SHA256: 43cbf0aa000f76fb5ecfa21ce0d5fb1e7035284529d3dcee1a7049ffdb9a55f1 SSDeep: 3072:4O3U6vSMIhoyqG2XJjnki7DG33dOkVLpueweiSRBe3VIrS2fPq/1VWsbZvuh8nBk:FnG2ZDr7i3x9my03t1VWs9NswYF	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 0cf576331eeccaa67130cbb232077ea2 SHA1: 1e8cae13d6efbf05287bc68582debe03807d0c77 SHA256: f5707fa3b896fab0dfd7a6c8be7bb80af616ae411c00264cecfbb37d3e2d2f1b SSDeep: 1536:/d6NfOW1M4zpaAiRU0j9HYDLqxJ8nxWsf0VrBifuM:/MTbDiig9Hsqf8nIscI	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: f9ea89fe94fbbbb4412d11f6b30e1c12 SHA1: bfce2f0a43466e625e3fedf3dfc23a13a0a8f101 SHA256: aece8147f8c75da0612a5814a5fa180e35f92953eb2bceaf6e7f22d88d0ac25a SSDeep: 1536:f0QuChotBF6Cp/yKrDkcdm8texbx2qXhJrNJlRxuK:f0QunzsCp/yMk0mhXJrHlRj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.07 MB	MD5: 4b608769a82287ac46c6b938309d1e4c SHA1: e9b2120878fd771730bc06b569f32568fc591fb1 SHA256: 0d4181aec7a50e4245cc5c1bffed66fa5cac23bc0165a6d63d83ff7edf54724a SSDeep: 24576:JUOyuzFDK6uHDcMPjyhNCzhbqyuDN/l1GL/rLLO:JS6+66YOn9t3LO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 82e996b7f4908ab8ce662feb4f40c97f SHA1: ecb140c93ed203a58283f975f1244709fdcf45d4 SHA256: 22526fdc1a57403d20b4ae6b5ed97ba85d151ff762e75cb8da8f7080a9294a60 SSDeep: 24:+Xo+WpeXzrJorP10zUwq9F0XBiopBjYMJ4gHf/PRE4dC7hV/nelIGT/DkPbQ4iVt:h+meDQP19wjX5TjTyKRG776Ie/DkPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	335.61 KB	MD5: ef5bf8582501b1e47a1c2b80b54f1b4c SHA1: ef18a548927963931bc080f531b909068a8a385f SHA256: 9c252274cd76b78eac965712a3ea4f9a801a551edee16fcb706e445759f9e2c2 SSDeep: 6144:lhpixcAd1MF0ItPzSJfCJMgrxU/lIbm+BNwge/QLWd5gdtAuwKjD8haxaDkdaur:IxccMF0IxSZmuWm+rwgaQxMaMD7u	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: f148fce56347f7fbfbca59bf6c07f3f1 SHA1: e844946cc23673e7b3406e33de2882f072e00f8a SHA256: 2f49512c7e07545b9500e2329bfa9a006a482c99e52280a2fd067f2c94a086c1 SSDeep: 48:Lhc1whnXjkQSraFX9819uEivr+VFrOynJtW7kPbon:LhhhXgQdeKEwugy67kPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	349.29 KB	MD5: e5eeff432058de7dce6f144aa5c51f4b SHA1: b8a5f1b8081815036e6f9e42aa0a36122eaddd00 SHA256: 9954a93301f92d34724ef4b4755ee12b3f4fce849845c26775e7ba01110a99c9 SSDeep: 6144:P1aNLcuxMAun/dDcKc1/X1UYXZMelHU8tpGAoENGxH5CQhitljfG1yvq:P1ahYYn1f1UYXZ9e0GxH5CRvq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 45f4197e02d90373c3489fc86a67ec18 SHA1: 7831f625d67dec9bad939ab34698b38660d4692a SHA256: 45ec767f5d0fe10744a0e1912d8b3093617c3f5afdc1f5a28adc9308a7769475 SSDeep: 1536:6hxYsJ35h6nz1NuU+WAHgS2vKQxPqGPli3u2Pqku:6MG5h6nzDuzexxxPq22CL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: d6c163163791c8b53d90caa361d72452 SHA1: c377c39924c652661fee8e012ea8857520f2a515 SHA256: 58240b315500df4d047f1bf023e78e990fd9a49e6b28c9c3b879978123280d76 SSDeep: 1536:iLXZGvpw5OqyWKZpVBHrdQjg2cddF+vqxxoIo6HvCQIjN+QX2:0pSgOqXMiE2cdT+ixSIrHvC9g/	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	63.79 KB	MD5: eb26188aea197a82200ba6a4a29c57ba SHA1: c8ff2f695f3c5a12c539208537740ca6e3913519 SHA256: 9d6400a4a7a162122a55e63928cea087e3117f0bfe33135799fad50028f1db14 SSDeep: 1536:MrCOuzEPj3KJB8YAaDnUa87+fqVxeODV/A4TxTsxXRd3LxOP:4COuO3KJuYAMnUa87zx3DV/pBuXRd7x+	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: fd50caefa9b668fa35e4a185b3352532 SHA1: aaa57ae9db2c361511d493e20b4e3dfd0bc6e855 SHA256: 273164a119797a0e5fb11eaf2791d4ba87364ca743c9094e29dea6e4bc9bd423 SSDeep: 48:zagTE0GBSKhvo408nE6wtJqmnkDjs7mkPbon:zrTTGto40d6wtJDkDOmkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 823aa20c0487e39e08516a440b04b4aa SHA1: 27545157be442c7c6269b253ca1372fe4c4b72a7 SHA256: c3e28fb26c694e737c2399ce15bb84d055f3ac80ca22e4932891ac02c0fddcf8 SSDeep: 24:KzIRMHwJIzHrGtbrRz1aPivJws9cWUQLCmKTKaYc0btsTJJkPbQ4iVt:KzWMH2aylfTxzcYCmKWTKJJkPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	14.89 KB	MD5: 38ae0bda397b04441c0d5478b8536bb0 SHA1: 921112ecad9d2cd0c5b0ed1de9dc822481bec9c3 SHA256: 51e02fbf6af8b021c5c75895763e58ab12b235d7ed1039984ebed85287f816fe SSDeep: 384:BWHnPwhJITz/W8Mm5Jn+m56nm9xaqwcwZ3RpKGfJe:4HPwhguZm5Qm56mrtypfw	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 13ba1425d3a10eed4351fcf1a6aa8076 SHA1: 3ad013d73513df1de2cb4ea24d78300339bdbbd5 SHA256: 96fd70b2ab9f12fa226bb460dad915709d2da32a6fa8f72d0b55e60c8f03431c SSDeep: 48:MMM3Yvo/dPUN+2u3ucWi9MdDMJyo6AQjbZvkPbon:0Iv6Jpd1mDMZ6AQjbBkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.73 KB	MD5: 11ab10a3a61b98285c892e456e3179bb SHA1: c53b84b227234a0771075454a86ed04231895410 SHA256: 756f789ef183afa16ccd63290a7f63229cf8c17cf76458a7f8c0ce44b509e23c SSDeep: 48:FuBVM8Cd7DrxEhNiOvJraOQM3CbLkPbon:E457D92vFZKLkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 5b48050ec2c4cca4f872b8dbedbf439f SHA1: 88f320465ab4545dcf02a1039046fce44175d1f1 SHA256: 887031a5a621b572734c3e054f1b7d43bd7c6406dceb8cabe38870903bc23caa SSDeep: 48:cOGIoz5038ZTfupyfO3doK9bBmIUkPbon:cr5jT2+O3dNmIUkPK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: b12ef61760bdee26a70b9865dc78a103 SHA1: 863cbd5949bc2db27264f532b59eb23cd3ad3e52 SHA256: f6ea04e109513addbf8ff181e07cf5ee7255b5d1d18ade6d2d72e48e7656245d SSDeep: 48:SoXJMZX2UjAK3ZnSwlG8JTR6HmudkPbon:OZ3A4n/GsUHmkkPK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.34 KB	MD5: 27b25fa07e1a8f2b5734136c04d6c8b4 SHA1: 62bee79235f50fb57717d78cca3e8657054d1df2 SHA256: 4c2dc7dcd85ce3f5a5a8c8fe8b689a83d39e732c073f964fe225c03c4e6fab3e SSDeep: 1536:lFpPyA5OFO6ECVl1xHch7mRoFOVrcvXFnl+R8iNaLYyKtux:lFVVOlECb1oCtrynlliLux	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 17136b7b5f11c12facb3373810f3114a SHA1: 44134b0b38c058d6084965366bcb146929b8e1ca SHA256: fb9d0b52f2ed6038583b5b110c8442549717ce34002b9e98bb1f72ff39154ba5 SSDeep: 1536:UA0X/DalHkbj6zCcccpiMmJV38MmsLM2b6lnLFG6V7KB:HO+Nkbj6/RinlRi5dQB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 9a7923f6ff66b3190efb186486945587 SHA1: 51f53b820594f15e4fcf8283bd19869c612208a7 SHA256: ce39d6d9563c2eaba657bd13021461c3fd91ff5b99c25447df758948963b0203 SSDeep: 48:DQncbjFzd10pyCsRKlvFngwbPfLfbgkPbon:DQnOdGpKagyfLfbgkPK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: bf6c8507a0302ca822a3e35974f9cdf9 SHA1: 474a78f65eb3110157d0f1aa0dee1c6b5e94b811 SHA256: 537bf4ebeac7b0212140db8028b5daabdbf7a4bb2cab4879c1a905b7cd131699 SSDeep: 1536:eDXv+lQFfe+9uf9bUcO920PGZegSZg2JuId7x:ej+q2gufxUvE0PGZergw7x	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 4d80a9da38ba42ba77ba412335ace89a SHA1: fae386feb8d21d72bc7f454ec1e0186ad436edc7 SHA256: f780bde589460c7e9de8b5e4cf1f7f338ed9ee82fa858524ef5e77138afab703 SSDeep: 24:8xn8vhHtdUXFyZpjb0p0XlGxbO2QQtsdGmwdaPy0ezXwTZkPbQ4iVt:o2hNWXFyZpjiSwQbGZay7wZkPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	9.33 KB	MD5: df033ea48cfc653e6a7f58daaaa56a4b SHA1: 8a172179a05d6b31db93484316e44af74b593704 SHA256: 889361bf0c564627a31b00a56ea946973fb69b712e8c755b2a6bab06190d22ab SSDeep: 192:rx9WDFIL7ZcVen3SdW4fgCRjIYSmweUzfEDgCci0HvS:rzWDFQuVMioCR0LmweUzIgriX	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 3cfac2b2672d66f44143a456bdcc30ec SHA1: 6fe86e917f903fe1e0701f44a92280a0a34680dd SHA256: df8a2c1257ddcd8ec804eac37698b763db2eeeff3cb6447afc195bf2f34375a4 SSDeep: 1536:AD43LZ840IHAhqacmn+KlNky/cdUSu9mj4epBxvie2OM:l+MghjP+KlNhBfeBRie2t	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 2557f98c0c6a1514c971386fc04b1c6b SHA1: 44ffa779757f60a4f8159aa2e2a2101928a9e414 SHA256: c8904cd2840f1095d3cfcee98c7383555b301cdce424157ce1a5143c089bb796 SSDeep: 1536:GIoHbZJAWg2YN25248fO0+YSdlvz+jpKO1nuWXghsfFBHSO3kTS:GIoHbphYN2M48fOwSrvKNruEG4yskTS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	390.48 KB	MD5: ea14f1af5a5d42273d2daa5402547044 SHA1: 915259d9f2e051598b3c8048c36df625daf1c206 SHA256: 6d4aa97a75c914f082a94adc443b25c737eadbfedb19c0c5eed8ab95701dfc8a SSDeep: 12288:AyrCHTlVwBnsBBd0vCOSrIAzAErY0r7BkS2iOb4q1:AQCzlVI3CFR7Bd2H80	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 689334f4f5bf626ce5ded2df77723252 SHA1: 190ce2b75ced22b8a46e80213c85aa214cd4759d SHA256: d4375311285cc15880e3e021820897e4beb3bc5129058587ab508ee71c24862e SSDeep: 1536:MveK4hLecZBLgKslRJ9/1+sC4NxL5iDUy4OdL6d5wXW4q1:MmPRtzslLhUyNuoy49d5GW4w	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 6cea7ed00217222e7a9a91c38f81b1f0 SHA1: 0fdc681209e6b3c984c352a8f5fced3e95a964a4 SHA256: 79bf1e415259dc3f877a242913c03bc19228a62eb2be42083d66e55460fa3105 SSDeep: 1536:Uu5JfQRB+7zXDiXmA8lVIHiDYetbYNAjRlBLNmfabEw:Li32A8lVTUeZYgNNmyJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 3ff84a4c4a237ab6e2784114158c8fee SHA1: 2c39cfe84644b101bd485976c5a7bb1cb8b9d895 SHA256: 63a4f7f490212dfedd7f2f808b8d5e7fb9814e87581e1967f9db67fe69f38335 SSDeep: 1536:APwbm8sRbqWxk8AdyoxQcPKyS0/iZfirxxOF/YMpn:APOpsbvYxDPKyPKwrxsF/YMV	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	3.98 KB	MD5: 0ae5fe61f5b390936fcff11e278e280c SHA1: d5d1872f4e4905063db9ae5bba23af5fb332c57b SHA256: 073ca9e374c7901e20baae195738e543a0b668739bc352682c78873bc737f6dd SSDeep: 96:JMffk254wWZazWVRUBz9zfjq6HKh4dvy/6FGiZkPK:GffklwWMAgz9bG6daypiS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	3.61 KB	MD5: c6c7a77e3b9b88f9cf7e3ae19b839059 SHA1: 0f61547e9493abcc2c675d083d29c9e75a06c7f5 SHA256: aee92ce31dc8e1449442a41a8091ac87bb185a474e938c60823837a40b746beb SSDeep: 96:i22q6Ha4K3XcF1So0uPKCjCKBf1GcZl0uh/DPYSLPsZkPK:i22q+adXc7SovVjC41GcZl/h/MSLP3S	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	515.90 KB	MD5: c4d45730339dd2d6257338906db4c556 SHA1: 40a0682b75a1450b5ac579a5ef37d79d7f8da38d SHA256: e8257bdea1dfd7359db79d27118f9bcbf3ea120f125f0dd41738b7d340ae37a0 SSDeep: 12288:SoEyEUbXJeugD2eGzcMGE9vOkOWvZ4+Hy8g+dD010UA3wIu92M:SoE4ZeDbGXOkO+RDQkM	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[decryptyourdata@qq.com].bat	9.87 KB	MD5: cd6166b88a74c821a60eff0d8d6458cc SHA1: ef7f06b2481c80105aac00f8a28a2c3ddfa8eb0a SHA256: 117e9509d416b885cd6d0132bdf2b47913fe094d50db23a42e9885b236aedec0 SSDeep: 192:4QWszDk2+nkdQ6ry1GGEPC1YMvvqaPIR4ujNq1TH/4/6:rhDk2Vnry17E6VviNq1bL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 7dbf1895ba2df48b60b3d0fe08f01b7f SHA1: 04b92731776ed453ce488bc9c0d980ac60b77b78 SHA256: 8d55695e50bc4f571dae37cc527a9345c47eb7be8543cbbcfc61645ceb005119 SSDeep: 1536:gFU3mV1ZqGixOIuQovzXd+mJfA2zoT5MoRSkmrlSTrRek3Q/mKnLV:wV1cGxINoLXd+mJfrzaA0TrRt4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[decryptyourdata@qq.com].bat	640 bytes	MD5: b17483713b9339f273f3488c4f84b6c8 SHA1: d3c6a5369f2f5a51478883f4e391139085fe9568 SHA256: e24826b86bdee5d1023c9cad3a567da0bf54558a819237fed9074aa833eadcac SSDeep: 12:yXOucZCqn/nSAcfRwbSmn7ts95nxuqH30kJGgxjLq6MMTueSkEub5kwxQb2viak:y3igZSn7tmnxu03tG8qCTskPbQ4i9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 06a0bbc1e82816fd950af4bd81e3efe4 SHA1: 203b208ca5e87f3876177bf8ba1b561d26baecae SHA256: eb97fb6c9d9eb463f548171b5f2d1e29b4f8809f9716f65c05cbad1b80f77042 SSDeep: 1536:6hNOJ7DjzcZ8I6uvwoXgN2YWRW7JZF0dqqnGe:Ay748uvw/kTkG9nj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	7.29 KB	MD5: 7d3dab66a61bdaae913b90f1fc6ec862 SHA1: 36a2e653834a6aef5d8414fbd5d543c36d8e3d7d SHA256: 9d5d33ee27cde8278892baa4169e12896798b7be62a6e13b4a33e76f6dfd22e2 SSDeep: 192:Wt16V6lwEEOEyDsGj9780RwyyxQmzDGPN+L5OiS5ZA45IIA:WPVV7ocSGVhxy	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	9.06 KB	MD5: fe93a6eb7705abf9c9ca94f5647407d5 SHA1: 9606be06aa9672809876d176a2589a7bc9d5d48c SHA256: 36433d0e8f5c3d075edfce1bf63436b0620c5ae9490384cbbc0496f6a65f0aef SSDeep: 192:9qN179oy7kQlirGQ6KwGYpHbXC4ocT9lG5BE+pA:9qNN9oy75YrfIbXNXT9l8E5	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	14.76 KB	MD5: 23c85fd22f9f07cd8cf6da175fd50504 SHA1: 29fd37c6c5c460c1ec3450c93c98907c0962561d SHA256: 1efbeea415ccc2194229963db165d91916fe11ca61b3e13c18bfb32b6e282ae6 SSDeep: 384:qLGZL55XYLN4v8lLJmbyrpkaxI4U+wKPyQ4cyrW6jdvFZY:qLs55UN4vWtmoPRU+wKqQpyK6jPZY	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: ab0010bd4604de7c57b3e01e8ef2252d SHA1: 20d6527edf3f1c879e139e14f6104be6af6492bf SHA256: c481f609a8ef5643b32a102b17b829771a37bc00bab3420aeb71910285663e66 SSDeep: 1536:2tO2QamATnR882+kejlaZuJp5YEENzwTR2Q7Rtn+XeWS:2tO23x2vejlaIJ8XZ4RtRtngeWS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	6.76 KB	MD5: 2f9227c0a3e960b7600bd838f19ebb90 SHA1: 0922b6e0a2153aca7dab938ef07f7cc7a1cf09ce SHA256: 5eabf897ea8cdf2cc4ceee780a966341d5b3961237ae5172564c1e602a1a9502 SSDeep: 192:MLWyWNPvi2J+wC+hve9Aviz4DI99hs+IM/UcA:MLW3Zia+wtve9AviE897sFM/Up	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	3.42 KB	MD5: 916b21603c67ca71825befebf3b7d006 SHA1: 10a62dd55285029a199136c1747c3b7b8fb827e8 SHA256: 121f7d08c7162a48018ef162eba490c7a2ca3c196f35d5854fe3a3ec4a409ff5 SSDeep: 96:9tgY62Ym6tp/EHHKZHFocfUbER0Co/s0zKdNDkP4:9n6sqDLUSYRSiA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	8.15 KB	MD5: 832ac7d2bcbd9b61e44a805eccc50736 SHA1: db4f32cdb6588a0bd98bd1f908c7b8f7559fb8eb SHA256: b6567ac67f26d324132ad8cf38f13089c94a7df625794287edc47e4e169bd351 SSDeep: 192:v6OXyZGoE/W5aK3xHcdmCX1GXRMULKgdxBfbUEM7c3uwe/QA:v6OF1uUKh8dmCUXRygdjde7F	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 99f266964de1debeb4fba40ecb63ef72 SHA1: 8ff23b8fe25bfbd204f522fb110e20bd6ecdea89 SHA256: d7881a24ffc3b5f204b87d53d0370d4ea8a6373fc60bd1dd0a672c4fea10c217 SSDeep: 1536:4LjykPSugujjHkXc+2Ya+d+Ekb0mcTmkjqE0VQf55KgSbtC:4ikPSVujjEMfYDdGcCuqEXfc5C	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 633e813527fda4ed744d66e21f295d3e SHA1: 24957a9a44c3bbd78987ab57b220615331a2517e SHA256: 2a56dbcd952e4360b817545c9a65cc763ae8ac3dc413d9f16e97949376e61e0a SSDeep: 24:SRqvsXM+KBpRfBi2Q9weZ2AkqZ+cUCeEZEWPcNFU6mTe+wQCVU+PAccv79k7CG05:s/U0Nn2eMdPEm3+B0Uh9k7CGxikPbon	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	11.86 KB	MD5: a2d6137da27c792ecc3c9ac9b75226ef SHA1: 06b0c73cdc45cda5f6a20433e9d2bc155c71082f SHA256: e459a5acced29f69312dfdffec2117773497731a1928eb321a2b008d79879bb4 SSDeep: 192:A0c2uVDng590KU0232uot2Kqp/IcYvKAykl1VJGj1HnAyY3XNtRfJOkA:Jc2uVNKUauoc7VIcCyO1VJGjKyY3JROB	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 6209790472d641489b643e50b4015960 SHA1: c8b46d2a5da41c28f6a45a1d141787fe95c7ea5d SHA256: a156124b067a9dfe357929fd3d734ffc983da68ead177b24e780cefe3b2643c1 SSDeep: 1536:Uk/EH19a+hO0sUhH/cbVcIkpTxlp2/n9DL5TM9BzOw:9/UamSUhH/cKh5p2FZGzOw	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.29 KB	MD5: c855a949c068d315ccddc0a817866b78 SHA1: 7d31981ecf8aa0c117fc813dd1795f6b06d9abeb SHA256: 5b74174a52552a84ad25f5b369f0473de5605fc910670a35d5e9eed3217120c9 SSDeep: 1536:KLHp66KdIxqsYN3FFeQDxhcSzgcNRAcw57S1kMlH12Hv3eMXjnr:K9Pobe0xhvNRAcOWWM1sdznr	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[decryptyourdata@qq.com].bat	2.82 MB	MD5: c86f49abdeeb882021902ff1a24ea064 SHA1: 340e59213323fc67da5adf004a45b51d6ebe8834 SHA256: f4c5317608a2886b3c7aef034a9bfe9b20f76d5579b6f33386f3aa8e319113c6 SSDeep: 12288:3yhRIDqb0yPG1lh/ZpHn1oZt0hAdjxyDViE3UniBv+vS5DEBGAPQKhG5XseUvYZL:3y4e5PipH27KHzv8PQ/2Y9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	3.64 KB	MD5: e9a1632d42e6bf1215e7adc298bf9946 SHA1: 1606300cc8214c8809edde1d8c2ab8a3e633ceb8 SHA256: 870cfc37a3840f15b640f3290f490f227702c280581a0378f4a4b076a2cc46cd SSDeep: 96:ylBQtnWL9iKRSy0TUr0XPyxRSf2IxqNkT+OFSu0mempVkP4:aMW8KYfoQaNkNAHA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	3.31 KB	MD5: 8872c62f9d29d151852bd52061c4e405 SHA1: 104e2fc3eb0abeb5e477cf9b48bae4380cd0debf SHA256: 9796d1a614adbd829b529ec36cc59abb588809d4d7451eb368401045ce02aca4 SSDeep: 96:r8WfyAu48J2pFwi8t7yN6VZ5BpW5yPUwKkP4:rpV8J2pFWUN6VLBw5cUwA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	12.43 KB	MD5: d33f5f93d03b51cda7febbf3d6ecd39f SHA1: a38f7c1b9bbe1dcd10e0a21818719daab6ffac35 SHA256: 9a6d90eba141624ff7dddc8db5ffd61a8ec0b104f59550f8bc9d8148ce4c1341 SSDeep: 192:JOt3SC/OekDFhBup3Uy3Zk9qi/rNpWM5k2yutXBAX+S2QNwR9xv/FjdNWuIeFA:cvNOy3VKrNpWMN/lSDNwJ3F7WGW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.37 KB	MD5: 71ca25e28f7d42de62302234079a6657 SHA1: ee8dd6feff70a50c6df287422f4aadd067a7a57e SHA256: 7902d39cb396f46c732c4ffc3e36895a18a54f153986ff828d0e8eddacc185ec SSDeep: 96:2yrT8dLHfCoMICwycFydfutRFJnyKXMIgrUvb6hfLMayYHZe/smYk13CfQj4QpKa:2UIsoQcy0tZ120sjyY5e0m7TjPKxA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	7.75 KB	MD5: be23d62a5844e6803c6723cd1fd9e8ba SHA1: e0677b93d3bb1ec22eb18db1cb755778225d4dfc SHA256: e526200711732716e5500a374d456bdabb9288ec66b364b267053afc54bdc7a5 SSDeep: 192:LzoPn4fBCzr8wmb6HBy28dqu122hLw/QdWDfOqLprHYDLGv9+kA:LzIn98w1ByLdJRhLw/wWDGq1YD6V+B	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: ef740b258c8bfc07ed868b9e4ecfa269 SHA1: f3626d611346836fa2d196f42bd5f5e89af6b712 SHA256: c02ffef7194cf120373866acd69f0fc115b2e0f9eb83cf5d004050029323d45f SSDeep: 24576:DWpIb0pqeUVWCiRA4vk7q9ehsiXSw9lUiD//aw50VMiHmh8Ck5Jg:qpIopqIj4hsiCH475xiHsyW	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 77c1e72fdf176cac0ed3e61317b556c6 SHA1: 521082679380d5f154f41e11237771497fd3b207 SHA256: a399324166ef8ad17545b8d0dfb4400c9912f579587769167527845c26f0256e SSDeep: 1536:zcMLDzxaSgkDNWrVA4KYtbcMxu5qMyE6b6gX/NMUbt78XSR:5zxatAW9KYBxxE06gXFMUbt7k2	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 2342d1c61a4177f0d6f1e8e30b74c8ba SHA1: c21913028255c254e2805fc5803e5f65a4225567 SHA256: 0afbebc7673f3b0e76be077a9fb5f67d0008128ea7af2fa5607445a4eb9b2db9 SSDeep: 1536:S0ll6yBTLlsWW0IRThK201WDpxE5gRegQYnW8Q/YBJFMRQmd96/:NXRLWjJRhKj1WDpxo4egQW1l2ye9G	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 61b9c361be90273db639a9ca54de659f SHA1: e62e0d36b6c7dec2df984d85bcea003c49503845 SHA256: 6e2173c73e06e1d60464cb1d1217472ebebb11f8f4848165ba0ef9797fbf3543 SSDeep: 1536:kS0j7X6YbJl4Mag1X7xwrk1rYi1iPKPcwfs2hyKW3Nqf+h/4Tq8iYgPf:kSEXX7zl1LmrmyPKZkumuTJi9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: af616bd37859218c3e0bdbff1c4dbeff SHA1: fd4fd18728e911a0916213a6703e9bb747e8d85c SHA256: 77a97683f1d0894af11cf0ecbcce654ce56c6318d2139ee2607af844e4162fd4 SSDeep: 1536:cvzmyfg3SUuYAufWe33H6+qz446Vg8eLuKhsENCapCa6gP:+mpLVp33a+kOg8iq5apN6gP	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.29 KB	MD5: 2c1f63b656983e856f5ea8cdc15857cb SHA1: 72a04856a2d829a82b5dd2075f2d2ba4c0559519 SHA256: 9dab5a363f1f765a9f3e69fdd88fa8cbc06b4ba91a8e08245da00973f55fef07 SSDeep: 1536:BUH+GH0g3fJSl+mHphKJaI3P25EtrAVtpiS0oK:OhCQaSPrtklL0oK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 2f881709281ad525d1fcace5cc042ad9 SHA1: 8190caf601d5b0ff6f935151e93bd43eed5a126d SHA256: a35a7b586fae8bbb49359bcb3c3a90eef9a3fff97020ae6aa74ddebaa2d7919a SSDeep: 1536:PuXfYYz0bnKrX9EssrsI+50kmtIfeWCUMG/K3Cnq07iKe:PuvT9Es0Y5OWCUM5WqNKe	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.37 KB	MD5: 2155f1dbe4648b3a890016ae141b5175 SHA1: c786acf40dcdfb6a3ba4089ea90850e0694c52fa SHA256: c88dffcf996fb985b60eefa30d6c1ad51e0575965eccba5fe558039e4d4b417c SSDeep: 1536:yi6QY323LKBgrm+tL2Eg5X8oWWztwUDI6pGqWveirp:yi6H3Dp+tL2diUztJPpUp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 64abda4268141e31d0279bd17a541b66 SHA1: 5ede3037e3060dd3102ee7bec24115fe59307e74 SHA256: b69c3a1225bb9ccedbe5feb6e0e01b192436cdb689524ed40d280dfff00cd327 SSDeep: 1536:htfI2SFo8nygGlFDOmDMkUrtQ7sZfxd1eJn0luOnvB/5jWH3lARhZ8:HQ7rypFDOoMkUrtQOlon6BRjWH6hZ8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.35 KB	MD5: 81b6d9795b155b8a4026aca7a40bc75d SHA1: a16d37a5a6431f267674fca51cce05e9775d6e69 SHA256: ff3676f874ca0eb0d8748e2bf69904d74c7436cac216d4b9d8a56db9855d6eec SSDeep: 1536:Eds4n/UrOWnUQHeB2jOm59IJMFennotuplZURqX11D0juAjQYJ:QnngOfp2C4xsotklZQqLYaAcA	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 4d671cfe562455926d93da17c37682ce SHA1: 18fa6f7bdf8d655ca743434ef2ac3ade76785f64 SHA256: d080b2e413ac66d6d0e84f1d244fa4bc6aa965611b50e5b99156d5b2b9704252 SSDeep: 1536:HQYV/0DiK/17Yv2OHyNMJWTJKnGFwOdj04uQjNjidY8D3kEqocztcH:HQYmDp7YvrrJWsGwyj04uQjgYu3k/Y	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 402d4e6eddd7ce96d3ee1316e900c27f SHA1: 1d7dc91f1c6de9a671080ee572ebd487deeaeac7 SHA256: d75d24efd63583149f7771559a323e2973605c539dc571adfb5c9fd7ddfe1f60 SSDeep: 1536:IUlfctc/sXqtzREcXfXZ0DjImyZMdA8UktwsGLt7:I+fchXOzrPXZSjILZMdkas7	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 9784af079b7ca253e05d675f2d1bb79a SHA1: 99acdba5a615c3abc1b36c5992d524d8b9feee06 SHA256: bcee38fcccace2c81b4ce50076cbfad1872041bc442e46a2e1f5cb40e880b9b8 SSDeep: 1536:J7neo4ig/IPTFUphIsfKlyzeaDDLhJpgyK5Ti1gNNQZ30vqS:J7eofGHfKlDaLh85Txm0vh	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 27a51abef318ada326a3abba2b13b443 SHA1: 1a9e268e882615af83007c73dcee6da237ddb669 SHA256: 8fc9b5daa4313d5d48f762be3f3de176d604ce1da2683131bc9c936cc6415bdb SSDeep: 1536:KPM8fbyOKCSdIVm79w0VWgOQadZKqUkroPdbPsYMB8OB:AMEMIwy0/6dsrWoRshB	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: bde59bbf6273e92250c716c6f07c4e0a SHA1: 4a9e5b8d7a8d2da1843ba850530446d6b0e0d1b9 SHA256: e600c2a757edef115db812cfa2e05defc7a738d4512f50219e688388027b5f00 SSDeep: 1536:GuDZ4NGtJ53MN/htejgUFfF82EfcFtXwfR7O9qCPx7Dr0rWf4YPQ:rZ4IbMnYUUFf5E2xwf5OVRrdfbQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: f98a2d87182c76afe71c4d57478d7970 SHA1: 3cf4c6c11c44d110c2ad42bde4e709961e3f2df8 SHA256: 8cd70c3e288445ba3b9aa0a2aefa7aa1535f6c444f62e9dc2cf397a1eb730ba6 SSDeep: 1536:Mik02tbZ3U72MUG3R//uLFPToJvfhb0uVSC69XRIzc8J9MKn3QFL8veC0:sRtbY2MUGMVahlVLP5FQFwve9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: d06028915de18ce3fad2785f4c2abaa3 SHA1: e23d9e1432174135728ae3e1d8631cf258a6026e SHA256: a175b410b68618692f3e1604885aecbe14cea0ad88cf9beacddc459050dca9bd SSDeep: 1536:7PrQEjMnAuXnJtPA6poIqUE9mF2s1IL9zwcXIiRrIp7lU:7Qn1AUa9Ey7du6	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 02287ce982ea9b13f635c840717acdf7 SHA1: fdbef02782e852ac08b2ca3adcd74de4dafb1174 SHA256: 5821ff38a4080d7954c76f902731813bcd75518c63079e3847bab1b70f9050ef SSDeep: 1536:NnDKDJmosbyjiqJjmrnooY38KXEoRBQTO3TnPeq0a5Bj2:JK9EyjSL4BkObPeq0Kj2	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 964d4cebdbd349b51e11a13f4d3c1255 SHA1: d42db88253f8438eafe6ec416b12f5ccb726754a SHA256: 7accfeea660de0aa0ae6bad5a39bcd52d613e9a737359afdddb7707ebc41a541 SSDeep: 1536:lP4VaQwgJFDJVBGa8ML4kjYQrhfoNC5g8b+xPT:lQPwMhYQrhANCSWqPT	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	2.78 KB	MD5: 7453cda338586ef31cd5740f08e55056 SHA1: 8eb38e767311646947548728bec9c5c494ce24c2 SHA256: d4cf59c014b918e4f9fbd8eb42e5e370bfefe655fc5ebe002232d6d2ac4490e0 SSDeep: 48:NfYwU4lpbp/EDPdW5OKuK9C5O65ZT3pqTvn/qFogVQiQBrf8yw5rTr482qgHkPb8:NwwU4Dbp/wbKPA8QZT6v/qmZiQBAyw5W	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.43 KB	MD5: 56c77368019abda46b95d9dcebeefae3 SHA1: f8561096f08a21b9bf7e964c9121684d7cda83ef SHA256: 2c93742bdd70e22395e8588af8964010128a150de346e5a1010786d3ba42740f SSDeep: 96:mmQ4Q538+SEuL0bShXb5590HxuGkGCPxH9bdTmacAZuqVF6Pnf3cGEfCBdePkP4:mmgxuwEV5aHbPgPbdTmaZuqVc1BVA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.07 KB	MD5: 2e91b1aa4039b0000f8456abdf43639a SHA1: f9af8d5fd99e5738946fa0b5e45940d922aed48b SHA256: 16e67bd0254104c348ebfbe82f8648b11764e910aa8f6172ad21360fd18c12e9 SSDeep: 96:Fpb2KD678pweB3nE5Qso91QbPNKd8JAYQh/AuWkqwcjRSU+3QudYkP4:S5YCeB3E+ubPNKd8JdQtAuWkqWngAA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.15 KB	MD5: 2f7c55e66f433a525f2f75d12a8f8f83 SHA1: d8b9ba582898bfb09a695f7feb037cc12f545819 SHA256: f87762659480b0914bc04d6011054092362497b6e9cdfb3281c48e8bcf864226 SSDeep: 96:qZxHqJjBTSjtxrVyWR5K/fFXQmuJ0Etiy8yeejWKNk1fVxJxFtPGkP4:qZxHqJoHrOxuJ0EtsymKNk13JxFTA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	10.59 KB	MD5: 70a31cdd2caa70b12be49effb92c95e7 SHA1: 27cff860c4b87a53df7d2f283f38b810c82d3d68 SHA256: 9ff256a8b45e08182b7fd3075e64c0c13f82fccaf79ecc97c5a9f8b974f26f68 SSDeep: 192:SYJFQjrvC8vw8Kw8XHfmsuea07uzlZZg18q6yPFcegzF6hDzMpVZum6azu+eJhTG:NFiv48KjXm07uzlZZgz9cegzEDKVMm8i	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	7.64 KB	MD5: b3f7e8febaa6619e017d3b156f729ed4 SHA1: 5db26fc93d1f4964c1adb0532aa13bf3ef6abed1 SHA256: 707f242894af4eb13ab808fa1fb4d1c64e7d3d2923012c505feb7afca4f83283 SSDeep: 192:0J8HNzme0T6naMG5GXBrFWF3yNARRpbi8VsWbA:08me0+IGx5s0Aps5	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 595506ca800ab806a94786f3e24c65bd SHA1: 8d9077c24957501c3b17e2ae7d3ba1b737f16aa7 SHA256: 657e52bca2234cf7e4499ad4289dca858c5e4f48f3e323c7171047fb86e3acee SSDeep: 1536:AIg+wgnnirrrD7rPFxpO348jc5EL5K6Qf6AocRDv:AIN6rT7gZlK6Qf61ct	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	7.06 KB	MD5: b8aefaaa616467d10212d2cafb9b55f6 SHA1: 67bcb6edd5ff313466e327fcb797869ee83f207a SHA256: 6c13c762c4034754785e8ab4de70f8ac6d29cd26ef094473e481ce22bd350bf2 SSDeep: 192:5q2PfU7hoj8L7hKPZ1PiyTNYeP/61W4fy/beA:2hs8L7EPZ1P7N98WMy/bz	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: e4e9b63c5799591492416f165c1b4f8b SHA1: f2e86006a91f0015d7fc3df6e4c5f2c9f91426b2 SHA256: e868f7e16f0f1f4f0f09671029c3219e2da26319126953e23dec42263a4e9802 SSDeep: 1536:Wv5eFqcgj7hs50i2mEstrXFuMYrRfhVc+o/LVr+OJ:ugR69gushYMYVcT/LVxJ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	8.62 KB	MD5: 7d8040502f7f5deedcd81b7bcad9d849 SHA1: f18c7cf5d736d62178ff97275d3a127c0d0188f1 SHA256: 97fccb8fb24a12880dae2c39fba1030c60304ce8d98032f2e845ba646289588f SSDeep: 192:gRS89zCxDJzBaMyFgLCLIFJsM1N9lX/hDRD7kZcVFv9Lqe6U2cz1D1A:gw8QxlBa9F04IFJ/1t5RD7k2VFVmrU2T	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.35 KB	MD5: 67cfe2bdd8479f5ef63b164e0af74ca2 SHA1: 52483d3fac792c5af109232f2ffd6dbfc883c613 SHA256: e7031b58fb973132a01204c502e63c26a9f10a9025c918de6daf32aece0a22b4 SSDeep: 1536:YUTs/0kwUbdg6/Oq9TjlEv9RGT1ZhSkcN+TwTy:1sske62OjmGJSL+Tw2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.01 KB	MD5: 6cbf013cc7e4a4e7f59deac21a8c7187 SHA1: 43358b46671d0fa5c23c47417d055dd470294486 SHA256: 0f95f7d6554a3174965de68061d496eacc2e147b77fbb47d2ba12adc74a3862e SSDeep: 96:w09fHleFMXEY6r86gIol5GRzr1ExP6FbRBSmWi4K34fyI5VYk3I/kP4:wuFUY6r8zj0Rv1MP6FvSmWtKZI5VYk3+	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.48 KB	MD5: 1718923bfe18ac0efec9e376f6c0b9c0 SHA1: 0ac5053082ab6fddeb553b82a16cb12abe141d17 SHA256: 16ae266800932f4c8f8cee67f6ae813672c331e6fdefcfc114954d60c4f898e8 SSDeep: 96:UrkqqdC1pjSgdpgTpHNPt67YwnEA/R+x9U6EidejMABAZJ/JtS5Pl1p3wzb81kP4:Urk5C3pOpHq7YwEUEvXSjXBAjJwPwzbg	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.36 KB	MD5: 07a0677af96bf1f7acc4f429cf30900c SHA1: 422b457f4dbc6cfd99e90e0691da248b6b1e42cd SHA256: 8da6a9ad65aecc89fd648f879cae178304197bfebc0de2f301535b24a0cf0f86 SSDeep: 1536:Cq8wjRuhktGIr3N08rVvuEK6/Ppt6pIX9hrpRLkVCqvI6V3hEdRB/r:P8URuiGI595eoP2W5pRoVCkI6w9/r	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.36 KB	MD5: 844ee9d1b79a6e1c1b73fc304d5167cf SHA1: 13f68a91f7d1f65f1f5c4969940ea5b752ad7545 SHA256: d8bf3915e0a25313c1b4d2cc5de4e1e8ee799eb2adc92c10b48940cee4087284 SSDeep: 1536:YESfH7TrI+e3G4uykilqjSjQWnQrfNG9Cft:Y9Trq3G4ufUqmQWnQ5kot	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.37 KB	MD5: 9477db0f3c37e870ec6d5239551f0bc2 SHA1: e2831c74982e7e47d7e616feb65f5d0c49ee5558 SHA256: d77d6870176401b815aa68962a37332f36762ce81bd38da8382249b1564eba1a SSDeep: 1536:uqvUHYTE4OrAZ79GHOjlU2xCohvvB+REsgvTr:uqvsY44xF9KOi8CGqR+	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	1.36 KB	MD5: d80b9e0a7511f5f0fd37c4b629714853 SHA1: 8f441889e0d70de4db292419cf4d68ee59278ec7 SHA256: 8bd6a41c461689abc732440b4bafded28cdd0705e48ee28e1343781975ccd588 SSDeep: 24:Is71Jsh7EBCnaEFRBrND9DCpyvkBCdn2rziwyB/1vGw5EhD7pdFnTKkPbQ4iB:I05BQa8RUMv0029u1vGxprTKkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	5.14 KB	MD5: 8b0b7ed208ac8cbd1ada9c60207cb0fb SHA1: 3d3a9b9fde87f3d1d1b8ce01b0e30c3af11f7593 SHA256: 6468e94b21ae97066be3b5224c38d7a3c53bc834a733369d9d5ba1481900235e SSDeep: 96:xW818SNFI/gnNkTGeEnzC15I4B3LTfEOsnAamLT0gs8GfkP4:Ph3SDae9zlTInAFLoD8zA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	4.53 KB	MD5: e0d825e1e034b4de9fac9a538968f42c SHA1: c4e74697ddcd3a5e2b1051856600aee2a6621602 SHA256: b88536f12ac3fc9b36dcbffeb8ec97986d79f6c878d91a17ecb58b354356f166 SSDeep: 96:GokNCTkJE1GYIBTTLpl6JwB9JK7mOnB6lrbJe+lUovx/VD12NVCFkP4:mCTszBTTLplhB7xOBuNUOx/6NLA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	4.11 KB	MD5: 3cceeff90e742dc19936d7226298f1d7 SHA1: fbb6e1f81477333678667c942d1eb5001b67a0ac SHA256: 8a6e44303f3f40f970ad9e0439883b3c3d07155919dc5186f8e91b2dd17fb471 SSDeep: 96:yDFSX+GgnfdAgvRFOUiPC1v9Zitv4//IySrTb6vTi5kP4:yMXA6gvRFOjPO7itg3IX6vBA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	15.18 KB	MD5: 52bd8b34f95b11600bae29d12e182736 SHA1: e07b13bb5fa6210a8a5e0f1c70f68a00b0a4e521 SHA256: 1c073084b9c504987e7a27942b258892e95a617bce4179aaf840df986cc3d0cc SSDeep: 384:pt+Bj94gZ1sYenUKgviVbYzqqFS/AswjESAXvmarBZLCvu:pqFmnUKeiVb6qN/AgSimarsu	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	3.54 KB	MD5: 65ca966c3007ea96b6da6f2cd9fe41d5 SHA1: 17268fc1d49abf6f76dd7cbe422fdd539fe09208 SHA256: 521dee0b83a4c72c21efe75b0ddc058e40b5d1a59ad8d5187f05e1358cd92ffc SSDeep: 96:FwWHecSYYY9h/zLwUS/bHMLE4+d318+DBsHYI+KbrikP4:FwpUh/wb/bsLv+dFtbIRbRA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	3.29 KB	MD5: 519c41b8e58b65ce110506e0afb8bb19 SHA1: e86eec791e4b46feaaeda67ed06d48220466d358 SHA256: 96c27363cc6d9c94724adc2a7c4d587defc4717d612b549e902001f255941b17 SSDeep: 96:abjvkyfUTyM7DybdbuZWAs2QCl6jTrnYa6Sw6kP4:aMmUTT7Ob1uZbIjTrnYa6SwA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.20 KB	MD5: f7047023c158620b818822f8657c0f3e SHA1: 907a94c982fe7c9932bb57e64bc9a7202c458783 SHA256: a7ad0b51790bbb98ce168708a47b2de0bfaeb880b9e07c1bbe0ca07b7610b147 SSDeep: 96:K/f7np4ANvYPCtf+myWrldYVqYEdzuPqkP4:K/jnp4iLtNjmVAu9A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.86 KB	MD5: e9dfd506eba7f7560ce759e32000f956 SHA1: 5248979cf72fa95812725abe0b8b3ce819d71202 SHA256: 837855df90ba53238c90c72ae1a86849347f95319a08e1d5a0ff2e23c11687c4 SSDeep: 96:5aoteF4EA5/bVgPCPydLjyWzJd/U6k6kZTVbf95isUSK6yQItcigfhkP4:TeF4DBgPCPyFj5wrVZV3i5A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	13.18 KB	MD5: 8decd5f514b55cd909cb3b52a5f508ea SHA1: 59f1be8b2597362d228586e78224136b3dabff51 SHA256: f5bc12217a6d84ecf5652aed54d083b2d7cdb447b64db445703e230e0d8bab65 SSDeep: 384:PeP5t5zabNec/wQ4UbaEvaoyp2wXe3Y2nkEB4fMAq:PeP5Lz6KQZvaZUwXe3Y2zsq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: b26ccb3de3f49fd73ee3d9b76f01cfe3 SHA1: 6bc28ddf37179153fed10424ff44083af8e96c74 SHA256: 89ae39003f221391ea412afca011b5a169d7cf293d6294ed3c4943daf96fc41d SSDeep: 24576:OJ1aLkidpV3m+kx96JZ2kMsWR6GWVSbUBnx:OJFidv3m+S6yhoSg/	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 4f42996ffc5f0adbee88e4db9790ec70 SHA1: 3e18cd9c9d59c06dc1ff4cac8755c42268c59824 SHA256: 3a2c8c2e44d72a938bd603dacb56b30ab2a1c5c565092f0445356b35934170a4 SSDeep: 1536:DSSqAx0zgqi9zYfEzxUwTJYEijjla4NwbkaZLbC:DSUezgqiFqUxVJ09PwA8m	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: 8b439ee52662081c53d2cf6fb1a6c18c SHA1: f996575356cdcc33a5161c264d4f8cca7355cfc1 SHA256: bc58715ce9ddfcc74f667abc6140f7da816e79869e3fcc30ba653f5c7c817123 SSDeep: 1536:tjlVPRBcMcaCcUxQvhedD6GOBKjf+XDxqez2OJzXO+QZAkpSD:t/RBcD9cUxQQdD7NaXlqlNLZAwS	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 4d2cda93acfab42346519eca086e410d SHA1: 572612fa40f52e637f75ab9b510332aacd75992f SHA256: 407abf2f6c0abccf2abec0ab3052051ae7d89c34404c2771df7f262da1421ee6 SSDeep: 1536:2hm9jEwiC8ESrnHGuYTCEXe8d1QRMXXDpTU423bwL2l:BPbJaHQOEu8LQ2lTUrMKl	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: db08df501f313a867550d0b069e197a9 SHA1: 02d9cc975fac588e2bf8149d84738a0cfac2b907 SHA256: 9ef444c8173284070a70e7c19163fd2a18be13ed232983caacdd808430683d9d SSDeep: 1536:cl5V6mi/MdvQrQEd+fXbQYCW0mR0xzfo3Sa8dwPdMSZbmr1aBULBX6:clKLo4rQEd4rQW0xDVdabwamB6	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: 85d3a2bfc952478cd81df7d62f379c78 SHA1: 29d9b78c36a598c0cdb7c8b3a517c981131d7f42 SHA256: 145dcc071414e4ffc90cefb81aa6a3268fb594b2b66b99b5c3d211ac30bb564d SSDeep: 1536:vbBM2qDqINAZtikA1Lq10GUsQbf5gbYHNAH81esdh:vbBM2qm3ZtRGddgbYtAH81Th	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.79 KB	MD5: 4de6d3120140e54fc99f5e2086e7451e SHA1: 471f1c4b9843d6235fabb486f110c8428ae1a310 SHA256: 739993c75b468a1cdf71e6597943467818cd58c786ea7ce11591fb46c3a9c686 SSDeep: 96:8owW1dNPFvgPUu6vKBbP1RwClWPwUguqQdTh1ZWoD40gVUMki125EWg9FZ1pO2bo:iWBaFBb0CoBdvA/9U9i1Igrvb/A	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 120e25f5d43b2b839a4e98261df05e63 SHA1: b643df749a282291408c9ef8ecf1c9f16efea9bc SHA256: 0f6abfd50a6aaa437421944ada86be654815eeeabae06c76b5b93d86d24b295d SSDeep: 1536:tRNdj4VvIW5dUmhJzSPrnRAtU+d8kE8yXRX4h9exjnxp:tWVX8PugkEBX9Xxp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.32 KB	MD5: 9cab9f835ca00e8f46a2a4ab60cbccaa SHA1: 49c7157f6b9c26ec98e848091a9efa1a818d8039 SHA256: e44b6b41ecca13cc0e9e2c4b16220fc3066090398ab247be2744a03f107ca1f2 SSDeep: 1536:gbVvhdgUIF9pqu4hthP9drvCZLbnkz7ravq1OKrtApYyu:ivjgJtpuhldrqZLD67+U52pYyu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: c638666bcbee72b12fefd61ed9d5ccd2 SHA1: e3085635955bca1a78c834b3a0542211dd76312a SHA256: 9874a3cfa77ea21f84a991c55d2073bc8f2d932f13a23610eacef8bfd3723161 SSDeep: 1536:hUR0wuB4nHPKAAb4t7NxKC/0ov+CGTDhVPxNX0J3G1fzdUhOtyjR5R:hX/b4t7b7/SpvTxV0J3+zdUhB5R	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.38 KB	MD5: 0610b7a035e4f151ac8abaf531e11274 SHA1: 638cebf9144d4888849546e712da163376e500d1 SHA256: 3ee4a89ba4f53c5e09128ef71b807197ba12effb118fe69314fa608cf927b527 SSDeep: 1536:TW2J4DQpsHfctoGzVyX1pDMnDlz/LXpddF2xTKvzlZ8v9pxitJRxg2ZLCj:62JwHf8VQvMBLXv1BZ+inRX9Cj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	10.82 KB	MD5: 696c7e5ee37bb3d2a2c169d5df3a2ef2 SHA1: caaeb369865159da0e30d7513c62f0c964720ff7 SHA256: 624e47d33d77127aec22bdbf042496a3c63d66fa0b004fe81c8bd05b3be3c3d2 SSDeep: 192:zlKXNnfOYWWltEQLkfsPjrRVtg2tuxd3Zn8Qt4LH6bHblf4jQn5syUoLA:zwXBOYH/Lkfs7Zg2t6d8XCHN4jQn5sN7	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.30 KB	MD5: c58e43ff46eaaef64bfc1bb96a64dacf SHA1: 17632fa65add970f29d78b4f458eace3b9abd448 SHA256: f10e9a1bb05f2faacc1102033c5a8da8d4b486786f748321c2650497017b0c03 SSDeep: 1536:lgeCoTwRnqUF3xSB5SCALzk7Sg3mP39KPtAWMmgvIL44:lgaTwRnfF3k5nAcYgPtA7cE4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	14.32 KB	MD5: abb17bc4aaa7be646a84b7c49fa61c82 SHA1: a64bd4cda30b3b78a10cf819460e87403edd68a6 SHA256: 69b5ab65bee1f31276f0f341dd61116cb2da2a77a2ba7f021c2f116e1d82cd11 SSDeep: 384:oM4l6IaxBd+mmAvy7S8TZtsq4p3dER8zKIeCGAY90sa5XODEU97QL:oqzb+mmLe4n4psOGAYisaJy97QL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.31 KB	MD5: d5ceec83829acae2594eb4c361d1f775 SHA1: 8eb4a7a2b5db27ab8900463eb1dd170095c59987 SHA256: 88fa2fc8fee0cd31344eb73f426df369e4074e60b92711a910ea0b0e228ae95d SSDeep: 1536:ydXpwfg87DfG/O7fyogu3UTUJiw4TUFU+grfFaCHfS/l8EFP:Yyg8vfGGjpZUwJiw4TUq+af1HfS/lJFP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.15 KB	MD5: f77ce8165d87173eaccaed56f2948d58 SHA1: 65e047515b46c3e5d41255680da078dc9d04a3e4 SHA256: 6dcc48893bc00e134e003d4dfb084d68bf92e353241ff774b2eba52cfa09d7b0 SSDeep: 192:lCM7GSiLGUwiFdvTteqCswgFEaRMx+w/5jRA7nF1PvA:4ginFdsqCBYMx+lFy	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	20.34 KB	MD5: 475d0dfb6a818847f78c8e148d4af11d SHA1: b5762e7d675a470fb3af2568e86490700d237cba SHA256: 53692b0e2ad4f70f4616d867eb674648cd179645b3dd48061263470d25bf6445 SSDeep: 384:fDkgjPNmbReS+W0hVQmqZCFi7ml3H0duc+z0WCUvuIInzjP:f/PNmFB0hJFamp0duc6CsRazL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.79 KB	MD5: 516e8cada12840c80ba9bfbadc6c8ee7 SHA1: d8b292ca1a0312d089b6c22a887841a167f76839 SHA256: 86db1ec522302d0a13eb77ddbe63204ec1d589ab31e69e7ff3e4149cea5ba332 SSDeep: 24:sCVcWlDUmTzTZ5jmdjeiWub2N2UvrbdAJVkyufBve8IhyIKEdNM3f4DTZkPbQ4iB:s/wHjCzb2EUvdGxYgKIKETxnZkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.03 KB	MD5: faf5a811f3b87b97b66bdec2ff889303 SHA1: c06bf727b754a6185d3153e8fa7ecfa8ccc7ee2d SHA256: 2b9923f32b265635390d254e063cf465156e2dc96f52dd27b8c636abc85e1bc7 SSDeep: 192:RA4NtUHl8dnPoltza19BsrjgidO6w+ffvbtlL3zU9FVVRHA:W4NtOSNat2DBGjgUO6w+DvLY9FV3g	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	9.28 KB	MD5: 737f13a636265d889bfcc878617d4186 SHA1: 3cf84c3035a4a601f8b67b20fcaf712301c65730 SHA256: 52d72117039b4dd2942d4d52b503e45fffc93d4167067027dd08f3b58d386b04 SSDeep: 192:I5S+C4WFj6OYl3qYf7ZA5jYJZxn4dyQj2pWsXx7eYW3ACM3rKbrAMOA:I5SdnYl3qYzLt3QU1Z+62R	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	25.95 KB	MD5: 54574fe117647792fe93094a23f09383 SHA1: 772e1da9c2115a61b5d112b79eadfd79fda5e202 SHA256: 9049ea693d0ce6dc99c573525baddfe07ccc7089f0e33b8933ec8fbe8d2f3d65 SSDeep: 768:Snc5n22fjf5QRugMuVKZ9TfylM38xbvuLJ8j38aYZ4pyPGG:Sc5ntFQuDuVKHfl8dvuL2j3a6pyPD	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	27.45 KB	MD5: b5e496d4e6cdc333ccfc1060b891cb8a SHA1: e1b2ba35779989f5ac69da5f0b21b7cb7ac9ac57 SHA256: 6b315de5f2f5360f5a1af00b92e75c103c694adaad250e889ec33930d1b277c2 SSDeep: 768:MlN5G3Y29w/ESVa5ofY73RE4aHiDatisPqtbz30hQhgqbrd:EGxXofY73R4i5sPqtfmQh9l	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.90 KB	MD5: 666f083beb70d8fbc66d4ea13ee81dc3 SHA1: d06912fd7be469ae1eaa7ee36b84a23a51f814dc SHA256: 746a6c4ae07fc040c9888fa4ef36fb67d92fdbba08534160a97545277a62b2aa SSDeep: 96:buRe4GWA1IqO7G1sXUciyrEWVBIw1NwnisRy8EvnH3QZE6hYkP4:bye7PqBQjgJyAoiso8Ev4nlA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.18 KB	MD5: 786a71a794e08ee16ab3e401da4b2030 SHA1: de4a280888a0376ba263e66cc2e8a89990ea99df SHA256: 5b5c452323791101826b45c6c990e86721d384ea51d50cbf7dfc2cc3e7e4b4bc SSDeep: 48:wLfCkqZ24S8eYbNWRQ4rVjZwNCe4Nt0shnT95NEjjvQ0H3UsvpQqnsirxkPboB:Nk423FXtZ+Ce4NXntcjY0HprxkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.93 KB	MD5: 247535b31c68f92fbb508c73013279c7 SHA1: 12efb90ed6c0544c196a9827b53e3076862cbada SHA256: 99f5b58e2830e214a80946c961325810bbd20ad8cc9cf0226d0fa39e27b44bfd SSDeep: 48:KUdH0MFYqijwD/RUPbGqIF090mQngqKZtdlLSB72Yy2Hf8enxwLBKkPboB:KUdVbqzG1WBQgqKWz7FKLBKkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.43 KB	MD5: d8cf7093d0a711454b7775d2ce4d3945 SHA1: 03628cd59ce37706c962904ed181b48a36c59771 SHA256: be2602ba4b636d40a241c770676ee8c6e3a89ce651bb4f96ad3dcfa5aa6de88c SSDeep: 192:5/nBBqfoYDR41Z8mGQ5KJVqdBuhX7BJsRXoYvjqTpyG28gM5A:5vBIu1Z8mGahdQhX7ByX4pyUy	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.61 KB	MD5: 528a6633d25f7e8b95bef475495e56bf SHA1: 42b187c672ab2b99885e232cd03bab2aa5e42ccd SHA256: 0df400b30f840b41a7f4f5dd33a36a2daebe1e22d973398e379bb795fd5ed8eb SSDeep: 192:D0Ko1fSVVjHUawJRt0QVYzxEILehr6MkGYGFb2Q0vF4HA:D07aVjPwP1YRLVJnGFCVtb	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.33 KB	MD5: 0b6eef21124e9da84875c5ffbf4dc969 SHA1: b93810a6b97df1b8955ce06b9851533171e64dd2 SHA256: b0b7b20b58802f592b146072037fe89eb6438ee4b0ad6b11c106372f144da9ef SSDeep: 1536:fRWvuhrJlm97bjZTvTWrdrXYtELG41Hl37fHy6w:lhrJglb9zT4XDTw	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: 20225eba4759d362fe5ce6d741aec4f4 SHA1: 33075a0fd2587ab25ee858732c52e62f978b7c32 SHA256: 6df94f0919b4eb04a07e7154f2207ad0cda3a10bfee87dcd340c6af2d0def53b SSDeep: 24576:TlVbptGMg6yuNQHz3oBN5GacVUxltMICCS0cFQRQtgT8o/4:R/tGTnLo0Wx3MIFfNWGTX/4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.51 KB	MD5: 9d9c088adb57208c9a01002d2ee61c6c SHA1: 7da6ef4be24209e31e6a44ac1445b948c48c54c7 SHA256: 60a2847e84f25eb64a2d87161977ffe394d26a8e1707af93f8d22f61a302e31e SSDeep: 96:cmPuwHt6p84t5iBk7sEHfWJDDMs/edRkP4:BuwHtmHiBfEHeJ5/eAA	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.00 MB	MD5: e2a63b13307cb4f25dd17935a00a27f2 SHA1: 97fe49410b51d1dc50059d9a3bd8f3b3c707d538 SHA256: 604dc9374b837a389eadb023e7470620f0a984ade852a34ff4dae12c70aac967 SSDeep: 24576:kxQTdprDFEllcPB6GLMdBZ3WREgrlUUpp1gG0onbh:LftsiPBvL+D3W99pp1gonbh	... File Actions Show Properties Download
C:\Logs\Setup.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.24 KB	MD5: afd632c06debbd0eab938e2551575ab1 SHA1: 7fe6394fb4062e22822c7f1b09057633b339c8e6 SHA256: 62bdc900b79d60bfb05d2c79a086cf1be736311a0c6678216288340b3b0b9bd8 SSDeep: 1536:IozhI2nGkFZmLAzOOKdImeBxGio1/UU33JsCP:Io9I2GkF7zOOPB491/3PP	... File Actions Show Properties Download
C:\Logs\Security.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.07 MB	MD5: 4ee7d8c9755ed2d1aecd470cca2224f4 SHA1: 35c6af877c35695bffa5e07703f40361518e20ca SHA256: e49964bcda44d3402a5a78dad450bc833274deec83b540648d7f3e7225b618a3 SSDeep: 24576:snPHspjsl6mkSQRCYiv5awLkx5tynuoNkemso:8SksSQRCYiv5awklaKeDo	... File Actions Show Properties Download
C:\Logs\Windows PowerShell.evtx.id-B4197730.[decryptyourdata@qq.com].bat	68.27 KB	MD5: 88c7dc5a1273147386d85909e9232954 SHA1: 76190746076b7e3a37956b5a28a6bed2c8973b4d SHA256: 1fde03ca1a2c889fa0bd04b1bc02437db08c692c1d4655d050d976f4a879b903 SSDeep: 1536:sUli8TopS/Aa2WQDS29oXT/p7d29SHgzTEKQh7Cz:sUU88Ba4SN/BGXzTEK3z	... File Actions Show Properties Download
C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[decryptyourdata@qq.com].bat	15.86 KB	MD5: bcda667aebaaf50f888f32ee83ac9c3a SHA1: 1da85be58a5ba8ee78b28f5749c10eda7476598c SHA256: dfc1c6ce0dc93500905acaff58f30a0f4f993e577d78eec74d76940b3a25f07d SSDeep: 384:kCrk5qbT1hcvOjnNhRd1TA6QhFSsr1I7W/A:hruI0mjnNh7B7Qh4Qmy/A	... File Actions Show Properties Download
C:\Logs\System.evtx.id-B4197730.[decryptyourdata@qq.com].bat	1.07 MB	MD5: c5eea9f6b6e1b75365f5d863890d6903 SHA1: 3d29855c493fac55aeb55946d006209653209022 SHA256: ddf459136a6b39fbd4dca0f4875fd071ff648f62eeae14daeb664179d872a484 SSDeep: 24576:DqOw8jQcjIelkkWU5a7sVcMc12QhdjFmJfds6YNDlBsfdul:3vj32g5H+b1DTmJfdzUpqfG	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	20.99 KB	MD5: cea7f424ba4c2a7b8e9d256d483beb50 SHA1: b086177b1a80764061f4c340bcb4fca957e22252 SHA256: b47ee6d514f2c4cab72930e8a6a853d84a9b8ccd7680a18c35f7373e20290b33 SSDeep: 384:4AGxCqt4Pjg1BNZhQSW7acWzw3SWFeIbvL3nk/YYoADe4zt:FgCqtIEJc/7tCG7jTnTYozQt	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.47 KB	MD5: 41f2704f822c8ed72707d90dc859a064 SHA1: 3eb3c35914b57a2ab792ee77d45ae040f2cbd4be SHA256: 07fbcc959eb89d839e96774d1992953d7640ad9b94b5d34ce9bf9266fcd195c0 SSDeep: 384:f+nmYH8mm9aY+8+gUC8XkmkizOuf4PZDgoww8ICXUjZ6F:ep8mmT+8+y8XkmrlQBkoAXwZ6F	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.47 KB	MD5: 7b58da84887be2fee192a2501371c373 SHA1: 000349a214e63d9e094cf75723e3bb783a0af675 SHA256: 376f6e947f5fa95f62732184f18f239bc85cfa7eb292b8e030d694204077a060 SSDeep: 384:UbOFBwF4yzZQZ3mad35we/tgo/qBZQeDve5sTBPAGFM3JL:7wPeZ3maBV/qBTvHFIGFw	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.99 KB	MD5: e37b22355aa7abbfef72df173a9d6288 SHA1: c14334ad6ea0c66b4e863aef44d225246095b326 SHA256: bdf5949dc9f9f2fa08cce1e13873e415b37dfa46f76425a202ba0a2f4d8c9a51 SSDeep: 384:/jGExiFqZDE2HG3+s2VfeYAL8j7AWLpM7mQLTxdAaRShD4Z7Ty5OnB4MmH1+Hw:/5s4E4GOs2Vfe98j7Ra7mmdRw0Zn0xV1	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.48 KB	MD5: 3537ae06ae7b214f959a29837ebe9ed8 SHA1: 2996f625fdecd482085f45cfa31215fabf5253b9 SHA256: 67b785263ce32230fa9a9d30866bf1a31278c7ab6cb4b2cd2cd4bfd1b9d08d39 SSDeep: 384:6lS/Umo9xpASHBPkjPK5Hv6t8MD2Pc/3GvW8i02/h9abYsrKqBmID1BqN:6Icl9xiSHBPkuv6t85PeWv4/h9aFHBfu	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.97 KB	MD5: 87e4ed0f291261409b6e38ae3750b6a2 SHA1: dd9492be0e446ebfdf2e5802f68e770cdb5d30b0 SHA256: 278d87b0dc060f94a691d684b0e128e29898f7684447a35fe1bd28ea2baa35bd SSDeep: 384:1SjufHNtg7ux00SDnlA2/J+0+N3rqaESWth1WdIGmWtY3Ao:AmNtMf0Sm2BYNWaRWLTWtY3Ao	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	22.47 KB	MD5: 5dacaf107487dad86be490a9516d5bae SHA1: 2c1b02033ddf47bc34f4e68b8346247e7d5edd66 SHA256: a0909f7cf14f092665ab88a94de92cf117764004779f0fcddc86c5a627d43af0 SSDeep: 384:6Jo8QU6kGBsKrKrdyzU0z6YRm5dOg8vwUIsa9sUTGfcvCempUAdtCY:78jjysKrKrUv6YCO7I7EOGKCeXotCY	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	11.63 KB	MD5: e26ed86f62ca720df1a87d9ee3cffe15 SHA1: 40d3a6dcb956a50d0c3e978942f5da05e6ff2ec6 SHA256: 32fb961c15b139a9dbb4174eb3fffc5a0919304abb478b8ddf07f4be22dbeb81 SSDeep: 192:rrYjCEOhbdG937uvXcY9hGff0KuHRj6RY1kiqCoTaL0jFz9GcL5fNkyQ6Ja:rHhK6v93HjkYFqCMjtNNt14	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	20.48 KB	MD5: d72c14fedd79294e96ac0daa560eecd8 SHA1: 9c0beb5143aa26285818b40b395d912befde4c26 SHA256: d1a3bbb07fd2709b7b17306e04f92f8da72c0822b3cf3c21c63dedadbb55dc55 SSDeep: 384:ujBCCXglhZQl2GdXTUsNjt1TZ7w6R62NMPEHK6PC7kXhrZko3sEnKZg:kCtlT42GdXljF7w6LNMPEHKUh1oEKC	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	19.47 KB	MD5: fd789d8b2721d91c94095f5ff9bf9dc2 SHA1: 96c4560861534f56869a347f502be39ea630033c SHA256: f47900af0219d766da96e7dce3c59ad32b0367d28f8b06ef4af62dba6eac4a41 SSDeep: 384:coHaLV5A9Klc17TQzRJ9d77qtQt95JS6rVxP/43zbCiaNQyWnhz:co6L09Z7TQzn9k29DSaL/43zuiffB	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	19.47 KB	MD5: 3055c6fd06deaac9e23ad79f34186716 SHA1: b62eda8b23e1d6f344ebe43e585dc597bd8b5d80 SHA256: 4668db0e8519dff8240401f0b56bd803b1a3231eb91b2f899e0640a334ac59c0 SSDeep: 384:PNbCpTbzXJECgjBGNpGuTtVzMVZ+hHJFIhEhsdTMRfO3N1Jm3enXtCIz:VbIbLJE9jBWEZ6HLsMO3N63o5z	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.97 KB	MD5: 998c5031d3d05a645ddd8c3335cb2ece SHA1: c97ed531e9c52e4d54323dffa4bf382a002d7661 SHA256: 99ac17f16f3cae3116beb08d26bc420f398aba4256258694a6685831e7182d7b SSDeep: 384:mGoKUR3ovVzah+ZL25PVklKItjyxYJ4Rp0frai+QnMwFCA:BmYdWh+ZLAalKI8xYJ4lanxx	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	27.47 KB	MD5: 44e56b132a98ba98a5c970ea1cc818c9 SHA1: 3c4dc2603ef6ced70031d2507af033f52e83dfec SHA256: 300fc90a64c2c1de4a9013fd68f412d31b92e7ba5b4be34d65a17c155117c9b7 SSDeep: 768:85uUBQVdwSXmZ+iqHhccUFjKTNr0unzZ8yM6:w/QVaSX4+iqB75Zl7	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	26.48 KB	MD5: a199de9f87f24baf3a7aad16ade2ea34 SHA1: f36794e8ae789d9d10a4636fcad5c88d0d3cdb96 SHA256: df4c42db2c311bc262847ecef6d1a47f7af76f5fad8fcdd7134e5097d37c28e5 SSDeep: 384:ruE7LkS8sWDgtFO0FrEy/SbxnJwS8KB1ha1AlixpOVwGWL9TXfTlSfFC14PgOTkb:yJyXtNFIxjGc1haAo0WFVpBfb0I	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	69.47 KB	MD5: c152aaa4c4313fa135eabb7f26c2607f SHA1: 8cf08ce3ac74985f819a0e22a9be554362f4eff4 SHA256: c7e7267da09001a88b4408a37dee1ca27b727a3257a40c802c9e1353c0f61c25 SSDeep: 1536:1PpaQqaShmcj07byQLrFvPyqI4uu7/t69M4eDdwvb6WLoqIQ:ZpaQLG07byQtaq/tcMxdO/oqIQ	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	19.47 KB	MD5: 8246accf6cf78f69410c1bbd74b27bd2 SHA1: 5e0fb44c5dd2c8005bbb1b702f8f09b719619e38 SHA256: 6078c2e26c607ab063fd9ad963a7f36078f597201febeb7adbea42abd9ae0f04 SSDeep: 384:aCcaxraCJrzSb5puM2L3BZkdXOa+ctLmFeuTvUYjB/bDwrlaXF+JW3draU:xxrhJSH+3wlOlcYeuTFdb8rladv	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	24.47 KB	MD5: 17fc2e92371f6d86080ad7acd8073644 SHA1: 495cabd6634a4837bd53c6cb8fcb4091ef0e6c0b SHA256: f4a086635c4d3610a58cc9684ba1c99323e4ec77e4bd2876bd86420a95891904 SSDeep: 768:+Sfrv3+sKJnb/sw5C95Ys1EhbRbGfLnHGhi0vsLpwcV:+ArKb/9C95kRCfbHGc0kL9	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	22.97 KB	MD5: 164d9372034aed48ccf7788a9170a756 SHA1: 6ce015dd942fd3e0737f3cfb11423773b497d464 SHA256: 1a12805363052c939b59da0aa71b0d0d6ed0640049bdc24436f38615bdd092a1 SSDeep: 384:tujwhCjoz3NK5QJkWxsFTrWnVl+4DxiGf3/UzXHbmqnskZxa:MoyYrxx0WViGP/UjbmG77a	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	24.47 KB	MD5: 4e418d18dd8f2a45c6b68d47c21a5193 SHA1: ac67b23b27e18db0d84673f39dcf4c7c98ae61f6 SHA256: 863d83346e8c4fac11a2a9eb85d968fe552332780cda65fc7092d8261eaa818e SSDeep: 384:1+5CgfTdsc3B1DaHqKkuV41mzAziExQtTauTNu2IpZNIPKgRN8kqYJL+D0bRHTX2:MscxwcT1mzAZixauBuV/NIe2JL+Ma	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	20.97 KB	MD5: f9e11a7317980623c3e9d977633bb3a9 SHA1: 1306166e1b462a387105f40affc9ca9e5ce7a03f SHA256: 7d4f1208eca505912ba28469de5c5f9192fbde8a0af81795d6be6cfa427d0473 SSDeep: 384:0XrWO8Kej9BT3a0AiVFexRvJdStnnyLM3DCaONtM6bvHq9KsVOvN/D/br:SCO8KYBTK0JubJdSBszHAx6/D/br	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.97 KB	MD5: e1db9e947bf6c269445322cb8c2ab891 SHA1: 13702c9ccb3573411584f05cec52040660aceb24 SHA256: de07a38c43b8f603229664022836ffa874800fd5aca4ad5816904e5524321081 SSDeep: 384:YEwQG5jCJlVmnzCrhVFFuo8aKDwE0gK524d5bsPAwPSbD3XiURY:4HCJGCrhd8jDp0gK5r6VSbLY	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[decryptyourdata@qq.com].bat	387.92 KB	MD5: 72efc94fd77df3dec8aaaf6f3af4ba2e SHA1: e76a5e15da9b6af5074fe4e13e49fe6fac80d407 SHA256: 612ab4e76d57ea97d7a568f1cb74d06b1a8d719dc194e07dcf499649756e1f5d SSDeep: 6144:PRPgP2ehICe+Uwdx7f4rD2w7uilxUBQBmOx/507n3gq+6M:P9YxFP/grDpEBQc6/y8x	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	18.98 KB	MD5: b13d40c42d3b621ec61e90e0353794be SHA1: e10668cdcb1e211fd809ac055c1d9658936389b3 SHA256: 26f11aebee98fd0cf1d2fe5919e65201b19c491af2cef56c2fba34f0b98ce38c SSDeep: 384:MNt/ipfpN1A+ZlvK23IfI++1n6LygVMfd9UImKyQf6rS:M72KiMI++1nMygCfdqKyQf6W	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.03 KB	MD5: fd4bd63bab29c11b360815522fe1a087 SHA1: e10a039f9a76d6811109a92196eea7d5e56a2fdb SHA256: d36dc782b4e0fbd11fd3e85122901b9b5fa2205e8adb7239bf8ddac638d293ae SSDeep: 48:HomPurSajTzRdHOcOfKuxFQzj01jrtFm1eXAKjjJItkPboB:HahTzDuhFQzctFm1ewK/etkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	9.26 KB	MD5: fe95685262c1c6b9a61cf8d7806f5bcc SHA1: 384716300f61225a411a430608bebd7c08e9bfb3 SHA256: 9d6ced3fef4c6454e352caaa2ef2e8f707dca118f477df97bfca5c789444ba60 SSDeep: 192:rPhYTn9yVVvHuB6mcqHtK2dKr8gpK6b9dGqCLKOOMegkvxk1A:rPWr8TZqHdI8r4r4peRxkG	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.53 KB	MD5: ba23ed9951d0faf52e8bee40f1598185 SHA1: 809e3096e8978397b53ded51adf45febe0ee36fb SHA256: 977b0e13d819701cb4fa33149c9a2c7ef0ecf9c2a156eca2d0926a31759d4a4a SSDeep: 48:s+Ogyj6KmXnHrn/PkhqCpWUyVagPmHmGZeMYb45MMiNY757A35kPboB:s+8uKcHrn3oFp2P8mrn45MMn745kP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	6.15 KB	MD5: 9efbc885352ec3ca7a7b20f960acb707 SHA1: 6b1bd4a5b242d193ce4c309dadf76b2e4b272b34 SHA256: 2466ebaf50c11f77dbf1a39b9d125467d1dd16c9c498702623bbf78cd5592de4 SSDeep: 192:kJ+C9pqod/mKTDx8B22CKbrr1h094n59A:kJ3qpul8ksbrr8y4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	6.71 KB	MD5: d223ab1c65c96ba60ae164b17303ab5c SHA1: 5e01ac762c09654175acf8e1da70632c42a08d15 SHA256: 2cde314a43b039da9f8171bd3f29efb18cc95917c1cf77b4e580b1bc13d32f4c SSDeep: 192:+X9/6ilrY8yAZtgnTpPSZz1Fp6NBxI6HZUQA:iEstyA8TpPSNPIIdF	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.81 KB	MD5: 51c8fe8417c37c6444ffc892896e77cf SHA1: 5352ce075aca49f957640a9c981cc0810c39d043 SHA256: 14ee7681694bf7837570f3ff6e0bf38940b599aecc0b8dc836cc2bee4feaaee1 SSDeep: 48:ELVrT2HFFQa83z07HuHHrLssbkX31Q0u9T05QqsLSiXAbNK7PqCpWl6kPboB:qVeHca83wQHXs+g1Q0uaRsW3bQL46kP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	6.71 KB	MD5: a4ffe16c350cc8c28caf00c419ffd45b SHA1: 6272cfbfe4d8ddb3645decee2700256fe8349c45 SHA256: 75371791fbbbc382c3ce0ecddad71d05b2c834a143560acd868a7bdb72493c0c SSDeep: 192:WRsRO7Xf6q5qBAvyz6Rj4mHRPit5xKU+QXJb1uY3NS+A:WCRuf62kWRjnrQWT	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.75 KB	MD5: 746ece1ab18d4e4509b5f25576e75b3b SHA1: 2ff87fef20e3e57de2e1d5c43b37aed870f4c446 SHA256: 384beae37404d7526abb691c7e3701a7346be0276c9d2d3fd9e08112d5cdfe17 SSDeep: 96:2wByKICBl5wQ8wA+tUKojRJDd+gS+kYqRT7t5lkkP4:2wByKxqQVAuU/JD3S+kp7vVA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.31 KB	MD5: 54d5554acd19ff56679a214a6ab8c854 SHA1: 53190083184f71b45a384dd04f7f9158cb3de8e7 SHA256: 84ac9903de70f89325f072c329f252b7151440358c73b5208474b52240761a3e SSDeep: 96:4CsTc437aWlZiifXpwo3wgQAL7m28a6Kdh6gT4351b5EEkP4:4C479lZiQNh589gs35nWA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.53 KB	MD5: 8619fd4a28e8b4d993f5663ab11eeec6 SHA1: ee32ac779cb2a5b612286e491603af781e65a4e1 SHA256: ccda683eb7301b6d085908766ca9761c9a862ca14b5cd02a0c2989ebf3ed3122 SSDeep: 192:F3u9RYDWKrE5bkmGlfXJVrpWF+BnJ+ye5NliRVOeVAARLA:MnYDWKg5btSPLHBnJ+V57i2eVAI8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.86 KB	MD5: 26ad09e499d8e0a6b92bb4f44afad414 SHA1: 48c1d8a86c4afd78cfb5759c7c535574e5f321d2 SHA256: cd23a5013e8f5302c54a1e215551983912176a3f246a7494af4df0e0ca2eee58 SSDeep: 192:szDKxIfgGEDj7a0WnpyjeboXMhauAq7SxA:aiYyjebhguAq7/	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.86 KB	MD5: ee893b295455f9b1cb2cedc9ecf1129d SHA1: d7afd454fbb0b3dc64698f2e09d5ee538d775f71 SHA256: 68fce6dbd448c3010af9b36a92de70afa56a3c4b8fe6f69b97a3476f2b17b2d0 SSDeep: 192:zgnzn3sYnnoNBWTK9lbkJ+6pc4ZlRbwuB3sQikJcBX7gyA:yn3sEylTbG+J6lRbv3sQzJYsP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.21 KB	MD5: 10c59f880f9098a5ae5f3823216184c0 SHA1: 83962ad5f9274434683cdfbe93fdea45cbf39a18 SHA256: ca4ea3075067acb454365feeb320fd7f17b2f6dc3144a965ebf80c25b03358f6 SSDeep: 48:XMET1tStcTN1smgEGDNNrL7Mn3O0X7SRFLXaIP1VkPboB:XXT1tkcTNYD/SeewLXaI/kP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.29 KB	MD5: a921745c419e9357ffe95178ce9c5ef1 SHA1: 5c27003baa1aaf84f73b07a7891218889e83a7b7 SHA256: 32c3182ff71dc0ed3ce0aa9b607794aab42de6b583db786a566b457836e43708 SSDeep: 48:yqC/eGA0mQyjha8hdHNhAM4kquLYXIS97RaNjpghwMdMlrc4DkPboB:yr/mpBhpIMKuLYJaNjFrbDkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.51 KB	MD5: 54903523889f364c344eac6ce2459da3 SHA1: 86300cc92b40f23f284f1794a56d33b9a442f57a SHA256: 62ed01b0fa7ead9e8a6cb9f68147295ca39fe0c6193c431425158ac79ac0acb8 SSDeep: 96:ZtqlASG+awDkJN0mbM3dj0gX7H2rEYkP4:PqFG+bs0mQ32aar2A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.43 KB	MD5: 4183daac0561131a338771561c8738be SHA1: 9fc83dc4b127402c0c42d9d07b30ae98a4103de1 SHA256: 8bbb2db514b58dd939af54953ab53d16af8893c07ed808572a5664471de52b1a SSDeep: 96:O1Dc3I+6UPYzRnUTnKU8l6IIhSbbrftl1shqw5Oe/zaykP4:2DlVcKUOuh+chqw5Oe/KA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.39 KB	MD5: e9bbe23d0dffab06d696f09b3d78bc0d SHA1: 30220f461ad6e4122bf90843b7623fcd13c88240 SHA256: c66473e6465837d03da59d0c1e405bb7b36e7d2742e26bef1fdffc6e2fc177dd SSDeep: 96:Zj8RaD2fVL0ZSonxa1yclFwTsHytEuhg1nDi2vkP4:J0aD4p0ZS2a1TXwTssEuknDN8A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.93 KB	MD5: eff3b0b17a2e4eb0ec6bb92e2f71b283 SHA1: 0509eda39baa3253816996b58ca5eae3196e909e SHA256: 1442bca658b0f64b310a75213f69d48a2ad7745238e81e37cb39fe563a49af86 SSDeep: 96:n7ECAUHau0BxVjZyEySJBJwrd+THHguvJMNW9JKOhn13QARIjGXfkP4:gzjX9VwrQTguRMQ1pQ+sA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.12 KB	MD5: 3904cf2fb86a3055722a5b36c1076a09 SHA1: 8a60505c7f19e5dd312b8a1fd45a29f22a9af35c SHA256: ff82d5fbad744222c60dcc25f221f29e2b39c53f4d4fa63a7e6715aff9de68b5 SSDeep: 96:gUDOWThVEUAOg8MrjWlhNkEjn1SnFtf+HjV+/pRGcOu1S5Bvy0u4ETmc5kP4:gUD7ThVE2dSSvkUn2zfah+/phOu1sv+j	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.00 KB	MD5: a625a22e098d2831b8f119bf9fa09f65 SHA1: e8da316406e6a47bfe4026fd6421a17314fb0b82 SHA256: 818da8709b7faaebfa33ad0a2d7cc23905983ece782254b18a7d4dcf7f901678 SSDeep: 96:4PvfPS/+NULug9+Vw0MUA4rrSvgXcCycSLkHYEE+ISI73+3xQCxAaUhhETkP4:GvfPUvN5R4nCgXLEREl0gxAnhh1A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	26.50 KB	MD5: 546213d463176a528b63e646d76e5558 SHA1: 3b18b2cce216e35dc8dce9b1c7d2074d635d15ce SHA256: ee7bcef765650b592595963da50377391a30b1d1ce079ea59b49bd5f1a0275e2 SSDeep: 768:uMct1/JHurPfSipREZslHFDMjSZSVavTiK1s+NIb:uMclIjKeFDMj5SrK+NIb	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.67 KB	MD5: c4c6104ef12b91ebe84b844009c80e2a SHA1: 14c88c830fa7cd598dcff9c9621a80713286c6e5 SHA256: c07d18c4c02d92262b5be2bf6dcb2fbbb29a0aa6841d2e0c2d1b2dba3dbfe017 SSDeep: 48:2wfot5TOKB6Ei09LbszCKKn7hqF0+YcRS1hJ0q07GlShSAJZHC+eNf8IqYJ+Dkg9:TAvOKY09Xbn7hw71RS1hJy7G0hLJZi+d	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	11.61 KB	MD5: e790c7ec2ba0c730b2a9fa673c7b1e4d SHA1: 6f55700c42fa82816bc8895b0092f6b3e97f5989 SHA256: d57a4da2fd241b90091c081682d50eb7f8b2c5dddce03fa5a75ce7a8db55c976 SSDeep: 192:/QzyIZYU4QpSupbg4a54F8YN/AjsizUKnYlF3HMC5ZiUfqo7uNfzl1U4Icsr6AhV:S+QpSIkl4F8YN4jjbYlhiUfFSJW1Nr6U	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	22.23 KB	MD5: dd9cd54826f5bc01c032ee1197223fb1 SHA1: dc8492272eb139f20c99e96d34d2e3b6ce18c659 SHA256: df7140b35269800b317a7041a5855d1c5bd3963130f54f758ed6695f419d0859 SSDeep: 384:Ma09gtwYpMTKBx2CPRCMKY9XG3CdgE8sRzOGNhT8UI2RsHHHL57:MX9gybeX/YY9XGij7RzO2hTw2CHL57	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	16.04 KB	MD5: 711c60c49c177d5b4d10e8cb42d41c7e SHA1: ce71fadd800ee319f1329baa819670cb94a863cb SHA256: 2d9fe323befc675c3c11ae7f4254d47399255acdde6cf15d916b76a0a2a2e562 SSDeep: 384:z7qEJL8/pcnd728uZ+t1vQlXnqu5lRduL6Yb8lPKJakloI0wq5fMO1T:CYL8Rcnd7pzvCaABPuTluw/+T	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	17.07 KB	MD5: 58eaa75276014cd5ff69750ff6b6bee1 SHA1: e39358dbaea230f2a5d8a9b2b99ab17ccb842944 SHA256: 9861ab006ac0effb1ec36063ff3b8d5bc9c1ba69f3c8c13797029f668b0ab54e SSDeep: 384:DDL5w0vEji3kJe7xrbCH3+1dcPvmiTJy5wJ1mcGLJcYiWm9e:PzvEpc722EutNLJViWSe	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.73 KB	MD5: 5bbc8de32f8e7f39183fdcf06e7aaece SHA1: 1221c1e847a1fff8d276cb7bade790052c039f3f SHA256: b1d7c309d3f991f79c405ff1248a91d81d1249d6747ddd58c4618eced01a6320 SSDeep: 192:Bq7Kf++KWuSG4IZ/7kLdwfw3REASZ5SGLHqXOfUylP2JV90f2l4A:t+d3R/7Q5dSZcGeAUyleF0f2l9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	16.53 KB	MD5: 317b6b59fdc5135350e08903c5cf1529 SHA1: 4bdbbaf9814b1c6f1fead167f08cf82121ee736b SHA256: c3293ae4403e60414db99f385f1db1c36e5c8535ecd112c104179ad4501015fb SSDeep: 384:4zUVPVknr4ZxOxmFCGbmnRRgJ3SPFJ74BNtJ6kHmDpNLiF:UUV2rGO/Gb6RyoPf0BPhHEreF	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	26.36 KB	MD5: ef2b1b55fa765b4bde39fd394cdfa89f SHA1: 2ebb702b350183d491ad584226eee41f60bc949e SHA256: 706bd6147d7b26be5762b4dfcf7a6a28352d7c2a181e0a16f76941e1a9ca480e SSDeep: 768:KyFqroN34EVBZjs4jslFaeiRx32ibJlxi7:soVPj+FFsR67	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.04 KB	MD5: 432983182dbdf386c16644c9d57e0203 SHA1: 2f6c5bc66f98ba918deda091bc213bf795c6bd63 SHA256: cc05898871fb26a491e50c72e57de813cedbb6c13d46d8bbb62850ed17f39bcf SSDeep: 96:gb71W1SgjbxnQ2egCkAAIGvxLH1zMin0Q8jDM05bS5R1a+B4tih4txVkkXLX2ab3:gbU1Rjb1CCIC1pr0Q0DlJSj7B4htxVUu	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.21 KB	MD5: 9f32aac85bfb8b039be6542cf66d7862 SHA1: 54a5aa406c8f90fe32876988ceeae2753a21052f SHA256: d86aa814696458ef5fa8b7781e06d09cc79abf2b4d69a54b5490ca2e898a8ac7 SSDeep: 96:Or+oUGmAx9boAr0BU9rZdGqsVAadsLamQyEMs1kP4:iuq3p9rvGqCpmXZA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.57 KB	MD5: ba1cad59bc1d99af47924d800c430552 SHA1: 497d62d9d8563eae5688a5805f6dbeecf6d39428 SHA256: 538830f4afc8684a3b02b84a8dd01108c00b03bf57ff8b2cc45b92ae40f462dc SSDeep: 96:6z4NkgGmJSEIF3z6yPXpbR3Zx/0D+uaRHv+lfIjNvOGkP4:6zB4dIFBPXLpAnQvOfIdSA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	24.43 KB	MD5: ca529774854ad063870f851cba28a115 SHA1: 74c451e70346f4b165aa0ae2ba1332c275efdc2a SHA256: 7cf2503bee678c5a3731044f949f29bee98d87c2576144787f0ac3b755c855c0 SSDeep: 768:ZOqklKbiGUvUj9wV9CTtXH6C5US8PqkEU:ZOqk0ive5XH6eUVPqkr	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	47.11 KB	MD5: 81f54ae81f760ba6620cb646085072f4 SHA1: d9f0eb018294b4fefb219939fcf78450613f5abe SHA256: 6038d18a7c11365ada6de38bfddaff65f12b4d20ddc04ed13ff0a7dcdc6405aa SSDeep: 768:zXq2etcb8qvnoq3rQzRcDmgFY9aDsNml0/wilnI0TlZnS2HU1KhC:zXbeGIqvoq3kVcDmg69gj6/wihDT3H23	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	39.50 KB	MD5: 1ffa9303935d17b05d4aa50e123e32f5 SHA1: 9fbd5a113dd92535c9c8226d4f360316ffd6fb5c SHA256: 6bb12626564d123824612be2437cb326224bbb7668bb1bf68d45071b704d4f35 SSDeep: 768:980owRQUGm5rCnCsxtvuU6Bsgiblr+uUsXRwLhJhnKL1Uh4vA/WfLNbhe6F6Ze:WWQNArwC8+ygUlrwsqhnsUhuqWfFQts	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[decryptyourdata@qq.com].bat	500.46 KB	MD5: 9c5fd443862b4352a70a985e9e94bbdc SHA1: b288c72d281cbccbb139205566d3baba30cc76d1 SHA256: bfc1c1a91c12434d4325aac319bfad7b43799778fa64d8737a9e90f7a47e3ec7 SSDeep: 12288:Ve1N+gZUipm62hodClAVH00U46wpE0eXFKqMkPz8rOcivUPVq:VOUgGi4mJK46JKqmOci8dq	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[decryptyourdata@qq.com].bat	257.96 KB	MD5: d26de4412485117927016090b3221509 SHA1: 05244af4fef232aba46c9f1e3a8277b999f4ded9 SHA256: bc484981ea2dbdf4a48802c81e952f3b7ac0443e8eb43f6c58a627bf7752eefe SSDeep: 6144:VVJN9/Isks1K0j6RC6WHSLAIEYGZXgorpPvZnWJ6qLu/wHZ6kT:RNVkYK0W4JHsbjGZ3dnoJVu/+3T	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[decryptyourdata@qq.com].bat	801.43 KB	MD5: 5b5173b5b83c502668312252ed21185b SHA1: 11b36d33d07cd593dfa9c1f124cae641909220d4 SHA256: cd69618d39154b95463dcdbc1aa1230ec9fe281aa4dd10b4176d09fd64b03c15 SSDeep: 24576:Z341BsVqYvFHBqZEaDtEtY3s+wnbwfcnMovkpuJ:q1BchuEa5EtYcwf2vvyuJ	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	881.42 KB	MD5: aae700ddaf694626fcaaa71e9219ddca SHA1: 9ebae26e4985caa63257e6a3ee06f4c6627a80b9 SHA256: 3ae51b5484f4b6e420e69466b3daae3f79d5a24489c6fac817c83c4332af7453 SSDeep: 24576:ByjUPrvnmwypCZz7Q0yt2AvA/7PnPAhzqULE:SUrnmSZz7QYeYPn0o	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	28.51 KB	MD5: e8edcb81784094323cf14f743ff204c5 SHA1: 4dc9bf1afcd1392c9d23b8585bc8e3377ec80110 SHA256: 875db3b49ee32e61bfcd62babadc1dcc3a8776241b03de33499090070fed3917 SSDeep: 768:C4ruqKlnu5CmSgYNpvN1jmwDcq8ewjTVTd/ceE/6U/+nS:CnlnVvTjz0dVB/xm6U/+S	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	14.43 KB	MD5: 83235ec20c3033e438da37de1b62e7ff SHA1: c94908cd28bcf04ef44e166c374db0297fbc8a48 SHA256: 80f5753cdd170e0ad86290bdba6cef317070556e1b401ac8bcadf86b1c9e3380 SSDeep: 384:EDU3DWxxDFoTGgWwqvKqdT4dtb3GfHGOa1Rr48:EgTStaASqdsHWfmOa11	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	20.31 KB	MD5: 1de0ff7829a69c4c7a552280f9bbf1f6 SHA1: a032178d572f9f791d492ee17bb5b8f4d612c72c SHA256: eb4698ec768f2fc0aeb3fd6b3fdf570143e8f6a474e29ac570e358c74d55aa84 SSDeep: 384:w0lUg16FmZRyPaHZP/gtpTQ1paXsPlzd2HDLyje23kIeb9znvH:J6FmZRxl/2TQ1pEDL4jUT9D	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.01 KB	MD5: d7e52b1c7f6a96dcb782a70b64fb7c48 SHA1: 4066072ec5cd5edf61a63db1a8e0c6e62b666a5b SHA256: 1e41a665f4ae3f06bed8e314f4a939eb8a6a6deeb631cec5d6775ce22e42c1d7 SSDeep: 192:7vErm5NhCF8zAxGaFGsTn5zGrL8f9bau/0llnwLaTBUBwu2KA:TE1F8zAxGa1Tn5zO8ftslnuaFUWrX	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	19.95 KB	MD5: 6092442b8d33823f5a8d8c4517d5a519 SHA1: b79d4e797821813053a8a3bb5e182a718ba05adc SHA256: 42d4fb8c0b3963e97bc0aaa1b8b583192e4ac079fb531c7432e2379a535b224d SSDeep: 384:iEdrxVUVvtgr7Q83yeB6HUmcBKsJFPr99VO2IfVx0cjz3YknnOAj6mL:iEBxWw73ncH1ckIbc5fVxBzDSmL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	20.21 KB	MD5: 6690d0345c36135f1a77e0d870366bbf SHA1: 1392192a4e22f2c37fe7d8aeec46040e2b8b2108 SHA256: 51343ad3e43592908c3793a60fd8c01bd6ac9b1d7f730119c1c44d2364622c63 SSDeep: 384:3iyzl5VW+uQgimCJNCZXs+aK3G8PhMusb9YMdIl8oP:3iy7s+uQLNGc+aK28Wuetd48oP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	15.61 KB	MD5: 3b4ff1b9065a1737d198407771695341 SHA1: 6fb1308927bb5a47f087ac68d59f22a613b3592e SHA256: 579de949ac099865bf34344476852648d3995c1b9b8f94c06b0aab65741c9461 SSDeep: 384:3m7EWROaU+9auJV3exRY3yScWqKxLfLzDI8kYhmtP:3mEaUEau3ex9ScUfjdmtP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	46.90 KB	MD5: 97d995caa34703f899d5698641af203a SHA1: d4fc3701cd8583b93808688ac026c3b46c27a440 SHA256: a5e7d7b13b7b1d1fbcb3a923034bad9ff40e37df1b6d777e454d7882aa1aec43 SSDeep: 768:7miQP7H90fJ+bXmvwJBWgazUDV+iUdIAUtxIz3qUIPvAMewsagd2eRUmUnBMeXRw:7tm0MmgRaADV+iUGTIzxEewsld2VBMeu	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	9.71 KB	MD5: feadded7a1fd7ace7cedb100c29613f1 SHA1: 0907a3a97662e3c32f0b78a7ac6432d6fded4442 SHA256: 8b03924e87c3d58b81a45bfe6930f1d074ca5192f3ebb0cf375b9cf6c1929815 SSDeep: 192:Iwov7oHIwK8UN0cYucu24cgp+ijVmnjZ5IfBOgZajx/L80ks/S2gxdirhA:IL7BwK860cHx+W4jZ5IfBOdLtkw6i2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.81 KB	MD5: 7b40749c3e35c4beefcc917e4bccc084 SHA1: bb5781671ae09ad5699f5118554fdb748ccfd510 SHA256: b7790000732781f3f27679c350467bb14b3e1f8375fa37449018f4a37d2ccddf SSDeep: 192:LEyzKAJ874J5XT9I5VyxNQaLG4GQTweox/mzzqFsEoFKQA:LFKAa74/j1XQIGLzJmvk+KF	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	14.39 KB	MD5: 2ced35f28e9f81cce6be0c83dfb7c998 SHA1: dceaeb5fab190f60d984b62d11e210839cf48c1c SHA256: d47366458b217e0542cbb9e3c0de0a2f8f456e384e25682dc50fefa23899db09 SSDeep: 384:qRIhBuou2v9EfrZd0o/S8q5+Ed8KUDaScN1i6052:q+Xuo9v+zf68q5hTU+7N50w	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	24.00 KB	MD5: 606e706b5b2d9c9b65dc886d5f28e443 SHA1: 2887fe49f46c67231c601f9bdc7e9f364c22b685 SHA256: f4bba364b1ce1457e451c17b5d291ac7a8089a8757b2c6fdf0f36a3eebbf7699 SSDeep: 384:9TzukrVMd8UPpfX0lJSLW1BMYNbeHLgCAXGWDV0RUwfLdjgtIKWCyrg8tXio5xgP:duAc8WpfXqN3MmbuHfLdjdg8JfT0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	11.04 KB	MD5: b36583fe24a6851ebe1060cd2980400c SHA1: 7c510a487d86a62a416a908c1ecfe911cd1d8816 SHA256: f87d8fdd59cf6424741e6add00a709e7f1680faa3b45387cc7c20a89ed9da4fd SSDeep: 192:TyTN5NH0su6adsBN6ArqSc+OQKquJUTSoshXGrwfkTdFi3WgxKJ18TwZA:GTNH0sgirA+OJqujswyH8E18Tx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	12.46 KB	MD5: 4d40042fbe06ce357aabbb8f9d743dc2 SHA1: b7ba121ecaeef4bd3bf82f1256736b6d11b4ea97 SHA256: 8053171033345b66b6bcb5ed23c27688f7478ee7a3402481cd892b72840aa797 SSDeep: 384:6bjheue6D8znsvT5d2OGzjmiASwxGfF+gip:ok2DanCYOGzQxUW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	9.82 KB	MD5: 18d0d9d241b467d91cf71431cd5d9064 SHA1: c4eeb6bd9229d8e74b2987a8c8083b748d6326c8 SHA256: dfef5b2a1ad5ef2edc09afcdb7e05045483332b8676e79c4096bdac56ce3fc89 SSDeep: 192:ln5iKRyBw5P4Rk+rKhPr3GyAKTr9tR7PhjtlHdugiA:ln5iAye5P4xKhjGJEjOg/	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.92 KB	MD5: 6b73db0fcda67ef9760e55c7186225c4 SHA1: 87ad4fd8cac729ddf5994767833fea6d90449595 SHA256: 778cd2ca2601dbe3a5c332f3084f7d45ed80650fd080ae38f83af85294341f61 SSDeep: 192:Wg5TStxlwhK3EGmNNMpOJRvyrZUrX+CvwXqg2blu9gSA:WUT+4sgzoUX+COVGV	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[decryptyourdata@qq.com].bat	2.43 MB	MD5: 69bb4e42ea3a518e9b5a841a8251dec9 SHA1: 9e360557ca278ce3cd7bc612e5d9e12db1781f4e SHA256: 98251d95dabc48a58c07fbdc0f9e12ccc43652136e8a41a99586029f01ebba89 SSDeep: 24576:d+iCZUPGCkqQ9gkHzxBTEWxek5swVj0AeC+TjW/t0yJYlojvDsnM:aU0NzxBTEWxeKsf5C+G/tq4bgM	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[decryptyourdata@qq.com].bat	2.71 MB	MD5: 145d5c5a6d015cd0ecd4adbb07f6a09f SHA1: a2c10b2bbde8b873500ea4895ed43cc8b01a4efe SHA256: fa631decd6f558bcc2bc3a960474797a127eca842198244b107340ba20ea12d8 SSDeep: 24576:J4uRh4AF7vfjQyiuBBa/MDex23dWDjKRQ8NYf2qVrYnQ2nubQgvjTHJArc:nOAFjtiia/fxKPeZ2OYQvbF/HJIc	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	325.40 KB	MD5: c96919f3b5ccee9d633148571e2c042e SHA1: 52c2dd8e633a4c6899165e0f8fd397201b9db0ea SHA256: 09eb7b917df70006190f62b222e798bf96841ed96b079e4b15554c38430ab9f3 SSDeep: 6144:hduMR3htb9fGq6JxFleE4mQSouJlipMs+7AeKU1uWaVv+Slv5mCkMNTE05tPoDZ:hd7R3htZud8mQSBJwpX2AdtWevRkMljC	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[decryptyourdata@qq.com].bat	342 bytes	MD5: 7ee438e2b9dd1bd454b4ec88104bc7be SHA1: 18f333c9e02015d5b00d23d00da32637f81a47cd SHA256: f4f71cf421e4e479a72ef74769413141857a4d6fe09e5c81b2e86dc6c2db70fb SSDeep: 6:CAbJzDLkuAdw2M7ivToLKsDE4uhfyauL9qDPRUKdjAWo:79Lkvy4TuKsDyra4Nyn	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[decryptyourdata@qq.com].bat	348 bytes	MD5: 71becb36cfa42c79138687c5017aefe3 SHA1: fc1577909a5a5ca4a7dd5a8bc1d87b3f8056eee8 SHA256: 8adaf3c9535951b2f1104d400fb997827ff9ae3a03ddea333a2f139f6173a858 SSDeep: 6:14jYthk9IZHAd+ToLIuPTtmvM4uhfyauL9qDPRUKdjAWS:14jYtuIy+TuVtmSra4Nyp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	13.43 KB	MD5: d1e52bd2450c0b05e1e249fb07a58c88 SHA1: 940bdce39428b1ae365e6347a38161606db2415f SHA256: 8e1d68d454eb13ac583310bb4e5bf5e59ee5204e8afc8f3f72f139a5f563de43 SSDeep: 192:gR//AClSy6H48GS3Uf4u503FbA0T3ZxsjH+CqrIBAiAj3Wh9joJzIQm+HW4TzXn3:YAySyx4kf4uOnjzCgIBAxUjL+2ezXtp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.11 KB	MD5: d187abca25a62f11fa4102b09d6bbae7 SHA1: 0c595de2562f63592d126e609ba98d0b70c49b2e SHA256: 6df376ab8101a4a19333de79710729b4e2c081f74268096f21565adcb60a6f4a SSDeep: 24:U66vZgHH1JQ3y4GwcmspR8/kmP8xkT4+bkPbQ4iB:evaLmyJa/n8mJbkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	10.15 KB	MD5: f570874f0b5a040d2b58fca297b43b90 SHA1: f603ad4cac736c6455e7f06eea19147edaa69b36 SHA256: 5cd9e9f539b7a7d0f4ebc49a1a2981a533c511500e02d05ab29e5525f8f11d8c SSDeep: 192:sfmoPLiCSEKE9L6RqpKocF4J9aYcWdofrJL8UwlIt4IHNImWhtAqmrmrMGA:kdj9SEKG6IKocMlq1wU4IHNgtCmre	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.67 KB	MD5: d3cfee5c57693ee7fc63b0a8277718b2 SHA1: d7316d1c6bf6caee8ff91f9c5dffbaed83ffd9aa SHA256: e6c9d1b92b58ff017a6a17a2d5d4471004e71f4ccd81f00c5ff8f09b36d6c123 SSDeep: 48:831Ivnu/i+i+ggt5Up/3KM2YAGMrmPRkPboB:zu/iI5Up/j2YAXmPRkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.90 KB	MD5: ade4598b2800f5e062ac448d916749e6 SHA1: 97d55d1f6f46755b5eca8c802a69d5f356e9a11b SHA256: ef80ae83c41c9b9883b5ac4a98fdb8239ed4659053f9a158508ed5b3e23a085d SSDeep: 48:oJ9r1utk+WaGBoeglJyZFkb8qzmYaSn+RkdLv8eR+dHVFfkPboB:oJ9xutjWaGBoe+JCq/DA0LviHfkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	12.92 KB	MD5: 3b127bd9516b56746583367d393991fb SHA1: eaf56d6d68993a2379297b4b0ad67c591dd69dba SHA256: 0efefaf895cce2978852a8cf549c13c964ccb9de5cce5901ce5436aa44e4796a SSDeep: 384:9XJDuAKBONIjKyY7WTzm3Inp1n+2x5a4vE:L6sNI21WTyYpNHl8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.14 KB	MD5: 18ed5c6ce9ffbc165895cd0a1049843d SHA1: 4438259f329de7d361fba3ea294361edaa1071b0 SHA256: c02625047ddd62035e11e2d493bdd82206418a5ebc3663bb975d0011353f47db SSDeep: 96:OM4FqQcCEPMwMzfkrm0+h3GrOXNMCCxFLTJdyYBWHUA/JvxkP4:OTfcCEEwMrkS5rjCxFT1WHU1A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.12 KB	MD5: 6756e2ed9e65857b31d186ded7fd7ca7 SHA1: 022341a342695b39f635575f8a8e460ad54d415b SHA256: 81d0fb168a7c421cfca0947c81a610fd68f9bf5bb42a10d076f3e6ef6b2bd53a SSDeep: 192:gqh+Z4Csd4d2F9KF1/1RwbMwHbw+StbuorM5+lNP7hUmA:F+ZlsKdU9W/1RLwHbwrtbfrM5+HPVUL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	9.32 KB	MD5: 4fa8e4a7f91ec64d975ce56b0de88910 SHA1: f44be16a91606485b638de83c8d64a186d4c765b SHA256: c2c942da66f6327c322765d00b2e1c3b18f99fa0dfd3826c93df4aabeff175ee SSDeep: 192:XUViDiPLyCdOecKr6oJaRozEhLwxHbDCbfgY5kvkpaA:Xi+xeccRJSmEuxHcfgUpn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	18.12 KB	MD5: 75ea26e7f21770d07fd5a79f31d8ca8a SHA1: b8f65802278d1ab7c72e5a8bf03fe725e451289d SHA256: 120994eb199ee1a9eff5bdda05325474fa8df69d62fe4bb2971287244b8aaa9b SSDeep: 384:c2NQ4PUeLegYj+zFpq1SB2eVZpbG3+sYmc6NnDj2HqGFvy2FtW2:laPkFZ/9C37YmcKP2dFF	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	14.34 KB	MD5: dfb13f6c73e08e899120acdbc3cb04d2 SHA1: c5dc27ddc3eb10778b2d40ff9c23cb913f7db2a7 SHA256: 70f782a39c211844f9551685a1a07eabe0e0efc6595810f41459eb46a9186358 SSDeep: 384:dLhJP0+3ZZbxY1B+WtYPa5hIOI2VWN+wCt+LlPfVgP1N:BHF3Zd4+WNQRMA+qLlPNg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.75 KB	MD5: fb572435353437fb5ba27d4c3477eecd SHA1: 58a1388474f3c13a01c6aa7076270ce81db052ef SHA256: 9c305af57204924a72e7682fa0c80c90ffa9dec3717ae384c7027a959755dff1 SSDeep: 48:d5nNVo0f4Xp8ZbZzvsANuJCCAdSOXHZa+nPaRSdjc3urHkPboB:vnro0fyoZzvpuJaBnSIWuDkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.84 KB	MD5: c3b8abdb14d78fa4c9419d0bf0aad400 SHA1: 8d3e1dbdebc2a41f3279885427ffe3ccc37c615c SHA256: cdef73ea9fe81421f2fbc4ac29e66c27086641b1288fd874bb892b5597fe64e1 SSDeep: 96:NlfbGXM3lH7KNJz8H1c9jnZIy+naGiypicSwnXIddiEdBAon60tp3vkP4:rGEqz8H1enZJAZiyBznXz+z60tmA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.23 KB	MD5: c2399854023f170e4451a68e400e4b06 SHA1: fb5d4cf6ad018db7bf0884a019c21ec4689c1417 SHA256: e6ff0c86b52c7621e900474bc87e87127a0ae6f479d6408ac06092eb05d9333a SSDeep: 24:C19Cs6vQ2QFkxkZA2fDyoTYI0ueQp4rR4RI7dhe7TgxpCkPbQ4iB:nYkxutJH/e6C+RehefsQkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	12.43 KB	MD5: cef1a73a573537b071a527e2d05df9f7 SHA1: c1bd38dca0cc462442cf8fbacf764028ae6b6e00 SHA256: b6fb7dc832e1bf5ceac8a650de1da363464518aee662eb26d4bca88a8d562fa6 SSDeep: 192:qdPCBdDbGH6QlrFzHikODCscwI5GDDNKe5rOawNaJMPGUHQX3jHA:KCXDilTNZsLDDN97wNMM5HY3jg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.73 KB	MD5: 2f77fe5e0719b6e1ae5059c565ac898f SHA1: f2ad09521b55ee6619fc9ccd057c3fed6090fbf8 SHA256: c4e71aa31b8657bdd11dd3f0b6fc745304b9360c18f62abaff954b405c3fd222 SSDeep: 48:LOysBK7KK8IHyvZsk2FKnLOuhauYhRZn06O7IRMZw44ukihcNItkPboB:KysBg96SkhnLZh0tn0jLiMkKaItkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.86 KB	MD5: 0db769970342129af6a33b10110db493 SHA1: e31b8ac216dbf0b5e18ab28ee85ef440b8926062 SHA256: 8103b955877bfe2af1f537c2ce3a21ec151b7fc5a0b6076c9c2d617414ad8c50 SSDeep: 96:jOU8ZQM6CjmQ0WfiWd8vk38TdM68rC035PtfButvY+KFZbiYJ9cSSIA6rLrLvHBB:iU8NjmQ0WfiW938Td4rC05tpolKFZV+6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.82 KB	MD5: 74947e525a20808618ce35d34a489aa7 SHA1: a92afba30eb8e74a6b018b7bd4579b043f1a2a74 SHA256: a99e360deee6655664823aa7adef004f0514654ec84455bc81c505c8fb9936d7 SSDeep: 48:02SE8hoJSd5lajImwvo5xOfsaqBLTtnjWTBPMaAx5c1SQv4ekUTXD/F+RkPboB:0xESrlZnvIxAoBntnjmBPM0SU4eFTX03	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.39 KB	MD5: 61e219332bdd26d257513a9eb346e957 SHA1: 73bfabbe1ba5ee8ff44d3e8d50df95d427d026ad SHA256: 491450b982d4c44adcbc20722d09cbcff50e283f4723d44dfbf008cbfba47c05 SSDeep: 96:/5Ep6KIdLAeuuD6Hs3BdA1YETa7Atfi9dcSYHwBys267UMKI7K2DzLkP4:Bg4dDssxdbxpvKQ/267Ug7K2oA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.18 KB	MD5: 7fc61eb812fa2825af62adc9751b9e5b SHA1: 149b22d5096367dbf15058caeb3d62580924f618 SHA256: 4fd2570aa6a7442de2e64d3f4f915574fe510cce99e8814322623c02f865d35b SSDeep: 96:+YEcGOlz+W1VdC9bmSHQ1jz8Am3L1wmTFSlpkPkkP4:+YEcJoW1qdw1kfL1nEKLA	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	59.85 KB	MD5: b65e1c95254d1e5f8482079a1cb9b3a7 SHA1: 0b385d35e995f19156ae1f3b2de5a612eb21bf5d SHA256: 6e14b1366747849ef86aa131323eb27bb982b75fbfb2db59c9980cded0330a6f SSDeep: 1536:3CKBADjsQZsBVn56oixlPQghdl90+rY4ewQYKjy:35ygysexffxQE	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[decryptyourdata@qq.com].bat	1.04 MB	MD5: aaa6ab3a802c9637f0e4a3d3b9485391 SHA1: a2fb1cfebfa5d5faa434e9613fc2fd93cbbac41a SHA256: 2b00b361eba233e3607d8dd14e653b2ce75288d9a20e23321bb59593d7aeeb7a SSDeep: 24576:Xfp1xTqAlmg/2gHzDo+B3RLNAeXmbYBfW9rIEr:h39llXDo+zeeXmqemS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.71 KB	MD5: c2ca4f608110ae242acceb18a3cfb027 SHA1: d4d5b382a30ee93a7e543807c4655638a7e99342 SHA256: e9a66a32eb3493bf9a23e5dc9a70fd1809bafdb92c85afeb46639285f4d269b9 SSDeep: 48:L58xkvJwZkfyk52M2d8tmASNtJRcEdgzcVkPboB:LiCxokfy+UdEmAgaBzcVkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.93 KB	MD5: 8af2e0e0eed8a2313fee6a67a2b6525c SHA1: fe11779a8f6118b7958922e1630b74b5c915b17a SHA256: 5c20382a48fef6f51d3bc1fc0c3c0f73d1654c99ae6ebdcaa0b96a62ee764ca5 SSDeep: 96:cCzzD/y14gOnNQUnRDYLiKlrhjrAcFFe2Hz2kP4:cILy14gOHRMWG9jrLzVA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.31 KB	MD5: 57b1d064fda878e4c764b4d4070d2175 SHA1: 973a3fed6470594d72704cd4621fe77e037ad98f SHA256: 8cd56c24536bd6814a78d7d4e7130d2d0b1ab5a037dbe4c9b219938c5624b0c1 SSDeep: 96:OaDHygOhTjxHnFhc4lQ9FHrErAIyrQoYJGXEwCeIBZmkP4:O3gMdF+rrsyrl24BnUXA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.03 KB	MD5: 432dfe9f8f426f600ac1dd4983d51465 SHA1: a7780ccf84fc2e6bbbc03efd1f14f8101e87affc SHA256: 167bd39d5b9a92338ffbaff2b01287ac335be21a7e8fb8ec2308dae1b5b23548 SSDeep: 24:EyVvs+opgZKFK8rbRghar27StC+Id0+pmlxLDqrsk0Ibi4TKkPbQ4iB:ZZWpyKI8r6ha+S+0rlYwkL2EKkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	13.03 KB	MD5: b3ee473528787f881003411c35bb7f34 SHA1: 7a64cec6e7462ec3f03ffaa8bb0e03b17b02562a SHA256: 0c270d43a76018d1fed655f0bdaa0e2ac02e41802de5708d6424a0cc1acbf095 SSDeep: 384:8McP99KFy37Nmewu1xdNwna5WZNXB2ieJ8mQh1g0E1:859AKNmw19UGINveJ8moE1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.17 KB	MD5: 8d9edc0b287ff09100e3931a03132394 SHA1: 31b10ece7037f617d4014e45b7c9cdeb97a1994d SHA256: 563d9a36832d4eb81c0fd70c4ee757ce33e5d0abdda77729ff10e5db78bb0f21 SSDeep: 96:tZ4yE26stNJGHT47oyZR7V8zR6ZJ6Er8t8Kuyj7JFUnKSnJUzvm9VekP4:T4jFsNIAJE/tyy/JFUn6zvmLZA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.07 KB	MD5: 586db74b3c4b38ff699d0c7e2a2479fa SHA1: fddcd52d7ed6ab210049069c263e0deb489c999e SHA256: 1f01704dbfcc9f382330580d0de1229241db4208d6d0758a7f0c7ea0c6d6aaae SSDeep: 192:0d2rFwh8z/jktRPjcVm8yozmNvuV7KHFdEpZGqjo6EjZ6K/L/g7Wy3YA:rRwGzItpKm8TmNG187UjisuEft	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	27.15 KB	MD5: a595afaa0c397285c445035007762d8c SHA1: b2c68cf15400b80d1df38deb7e4aa8074244f0db SHA256: 6c78f3113302b793ab85c7ebf5673541986f3bd3c1386f5600538c5b55abfb1b SSDeep: 768:EBXT4Hvwp8s8TzbfLxJ6aOgZJmW8N+51/ALOpSnN5Q:OTOvyw3xHmWKU1ILOcN5Q	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	11.46 KB	MD5: 04a4a46d26836472657105fb41a6a1ae SHA1: 4e2274b2d8c181ea19d5d537daf96a1d245f34db SHA256: 96885315f8258dfb61e2381accd6c74fa2e8cfca7360ff3880a3be32c4f05403 SSDeep: 192:juaKJ6kP5xzngUbHPAKXQGQv8UjgHb6cfgh4Du0M1OoCnA:juBRxUUbvdRHbngWDuT1OoR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.93 KB	MD5: 4803e352cfd7ddbcf7b97d76af86bbe3 SHA1: 58515c02685c63ac871d31052fb08fe81b3dcffe SHA256: f7867b101655b871473a71d2fd6899c4c2432c4cac02c280034d782b02cc40a0 SSDeep: 48:4+Ltg1tC1AM0upGPW1nLxTDnEbBgvchRGwDmgYBhnkPboB:hLt31tAexRGgvc1ehnkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	6.36 KB	MD5: 996114a26783b504d5705fddcdd27bab SHA1: b12e59fa3c86bb251071572a13b891cf637cc1b1 SHA256: 2018c5f2f90bcad3d00a3800e1c24039899d2e5f8d60217881f1524695e1538c SSDeep: 96:qjKlaKEqZkIeQR3wisQ/YTD+gE/1PzYmxX4aHB+428z8herm+2kP4:rlwId3wisVTjEdPzYk40z8hermaA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	19.26 KB	MD5: a2cdb2f89f02ef10cc549a71c9ff1d03 SHA1: 1515e44b9cbc4ab1fd826335250a783cdd980db9 SHA256: 7751e8e3c0315607026535519c99ab51cb61c9d1b9537d676ae0ef7e5729ada4 SSDeep: 384:i4946mz+xTKr0nOCDp2DB++I6FNXK00Av2QcLi+sgGTDviLziVPqAHmXZq3DipY:i2mz+gonOWpv+I6P0Av27i+hGfviyjmI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.92 KB	MD5: 5d21f281f6729275064c05a873d387cc SHA1: 78d916ce86ef844291a433259c771b3add0dad49 SHA256: df0efc95549b0314c6e8454323ab4a16cf7a7b8af7c626a8510f41c4305cea18 SSDeep: 96:moqXIdjyIhpuYcjFGFJUcif10u8hiObVf2zABNAWBsRfDN0OM35PkP4:mquYaGFJUcieaO5f5NQfDODKA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.50 KB	MD5: f47b4004286de7f92650c222e9eda485 SHA1: deb966441ee5a698d41c097113fb088cbda2a10b SHA256: 49cc4817d7182aae90e03934d6a4eeb52e95932d12ca72de7e99bbdc7b93aa82 SSDeep: 96:yDhgrPt/1NDjqEjGaZi8E5AoT9D0VhwTcUkPg:yhgrV1NDmnaAvAo+V1Y	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.54 KB	MD5: 9ffd69592a420c39fd6b71ed630e5f39 SHA1: ec2d8033bd2fd1851e50aa775193766512c60c88 SHA256: 2e3cb32a5c18336728ed3b2d4ed44d0561eff8c97135ea084f89f71f937c4cfa SSDeep: 48:BW1wW9Hnofkr2WCtho/0EW0fZEqtkPboB:1WlnOM7Ct6/09kEqtkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.03 KB	MD5: 47dab57f3eb60893b1e7595ccec3d784 SHA1: fa39a35e5c1a9c3bd05d5450743a07fd290da8a6 SHA256: 3d49bda7de1e5a44920625fbbb17cf2ed99e87ea994d29fe44d5fff92ac3ce5a SSDeep: 192:CaRNGALPBEAxtxGMBCGONFzyO3sLiuta1JH5GMHR7PE8xPFwA:nNtLPBEitxESqXlVpxPFl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.56 KB	MD5: abea21147a5cd53649875e287c7cdaea SHA1: 91b952bf7ddb6ba2184dbd3381972f88b860593e SHA256: b6d002456f669ebf3da1116905978233068578625f46b7b4dd8d274e6491df3d SSDeep: 48:b+SBsiA9e8ByYgrkiUWHqqsjII2B9HYuduAfLlqVSaGP4kPboB:bZ+79eLoWHX0IIOlYuduAYdGP4kP4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[decryptyourdata@qq.com].bat	350.46 KB	MD5: 8524b6dd253c5d57e6ad8d4d4913e62b SHA1: 602221baf9ddb47ed87d33f0cbb6965d45cd3319 SHA256: 994d95949912bcfdffe80c9de7756a98ffa8224407088a69b27b7d6c8bf7ab3f SSDeep: 6144:oNfTBfEmc5XCRwuaqWfkfGxjAjySTCoT3+YoLq+di3WsXKDs73GmaZ0KFLT7ZMOw:IByIaFaMsjySTCoT5V+s3nXK/Ffp3ZS	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[decryptyourdata@qq.com].bat	6.44 MB	MD5: befaae9cea9d9410ab2041bc2c4f372a SHA1: 70890d3912d4333da4c3ab6faf23367aa3cbad42 SHA256: d577acbb183d335e57122fe805689edcff28f1eb1e939ffd30075889bfb52a95 SSDeep: 24576:zBc9b6xjOkUgs8Rvi6w3VXOcRXC0rkhOfI56J2ge5TY62G2V5iFlRhJKvDdZ:zSbDkUJVecVC5QO6sgeVOGScRhJKvDv	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[decryptyourdata@qq.com].bat	973.46 KB	MD5: fe81129521a7dacdf09563386c5ba89e SHA1: 05023c9b84e7c27118b4856250c66b32ef05fae0 SHA256: cf8f29fa958189028e7ca80bf7776dba0a46f4d039c2a8c0f0a1a316e296e32f SSDeep: 24576:XetANWc6Ezg9SYJ90J/t5+FXHNpIQjHq/nHRwN5rmtAzIR:XBWc5g9DJq38pdsurrSR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	26.65 KB	MD5: d22ec34640802a84bed6ece441a1af59 SHA1: 3bbbac6e575ad95bb0054b3977332964beb6373c SHA256: cd4e1a64eb5b52216829ab6cc04d0414090a02fef2e1e611aac0e06a4baeda38 SSDeep: 384:tiari13DzH+0uc1cnhGmV1gBZ1seWNFBIvVVgNh6Yj89iyVw8coyXmqKsXxQclCl:lriNXbQV1gHvWr6NVgNh6f9PumTsePl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.36 KB	MD5: a6fbd9ef19a88281b725df4e0c19ba13 SHA1: a258ea6a6cb7d76442fc5f4969b3e6513b4ecca8 SHA256: 5203fd445c49f076d6eecc64487afd68ad58ee374b532a34fbd50a9bdc12e2a6 SSDeep: 48:dMSH1ZffXHu1d6fwrPICe6GNXJS02w+1r5wq9MFFV3OEjxWnLErkPboB:eSHW1VrjezsrRi3VBuLErkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	8.40 KB	MD5: ccc641425df881612cdfe64bb6a02099 SHA1: 5aa056c120f409eb1a7c4de9b0ff761373645824 SHA256: 9d6da06b0f8ae4d27fa40a3f034787441f3c4fdf8503e78205ec156cccd18c74 SSDeep: 192:Ig3co5Y6T+bB38Kk3CqjtZYMVxKvTP4l3jlAXuhRpX/rGA:93coTql8K8CqtNaT4lmkdn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.11 KB	MD5: ad3a1465b57aeb83a2c8e1eeef7e4e5f SHA1: c9445f4b98a6f0df277e1738d604420634c4475a SHA256: f1f75cbf5b008ceea41c773d2dbcdfaee2da52a1442450768ce4ea3f007f950f SSDeep: 96:hh13ZK2kTOC34e0ND9b9xW4n4hd45ZXKJ8GJyKP2ia/G6jp1fjGY3n/sQCp0skP4:hhI8BxWFd+Bo2S6SMUtQA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.54 KB	MD5: dd84dc0f4a547a28b32d871adafe45d4 SHA1: 84c9608ba1bd9204612f2f5f39787c32ba399266 SHA256: 6c60c02333f92a142f00f7b56aff688b433fbfb83331b7f86aa7e6666887752a SSDeep: 96:/xd1Rk5jMu8lQ2FoTCT0dDJgY/F48qUuOnM+kP4:/rHk4Q2/0wY/eD3OncA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.28 KB	MD5: b5831393977241372ac0977d5d464adb SHA1: 28d45a4feb6dcacad9c6cb08affc4099a7c1f564 SHA256: b81370d269836adb6021a6baa6540606908ad3cd9c679497eea78b420d7309ff SSDeep: 96:LjDCdQ7QxTDj0Pl/iabawusK2qyUPtkP4:LvCwC0ZiaTjKQU+A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.42 KB	MD5: a1f44cb4b18ebecdf4c3b5215f4595fd SHA1: f5a212ac4050e99b6ab96e082f9e3905b4a0d884 SHA256: 35580a99370e8dc6ad63a81b26bbec28d2fe63c55d3b6e45820815df90dd526a SSDeep: 24:HgyxmhCfoYMQfPPsqcSxYVxh+gqG+Mjh2tlLaUEbH1BiITWOr/p7DTHDkPbQ4iB:A4mhJdqPcncgVv2ljEeIycp7njkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[decryptyourdata@qq.com].bat	28.56 KB	MD5: 6090329230aec1a9e303a2e31524ffa7 SHA1: 05f251c96686a57492b9e78ce1ebdb5d568b19c0 SHA256: 52975bc24d1209d91b8567471df4033cf62fe6246a7de21c7e976cd2be248abf SSDeep: 768:QM8FbA8LylPNd81RcnO16WHD2242CWAEQlC7NN:r85A8LylFaunOEmDLaE/7NN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	5.68 KB	MD5: 5f1165d48ab134a6ed575a048d0c3be5 SHA1: d897696a7edd9def1349d126151a7e5aa4092549 SHA256: 3961952754367b62ea8187ca4ad5d2ee957c54e4684fbe15d41169d9ccc8d770 SSDeep: 96:1yK/wIWxVZr1NArvO9lZvmJeJ8wvMj9k2wD3TpwRuFycefymz1NqX1+NQZlFZAc+:J/wDLivObZvmfAMjED9OuwcjwTqF1pZO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.68 KB	MD5: a68cce1a00a8e070eaa9195f977a89a3 SHA1: c2109633cc7e84dbe95e009399eb6c17c2879b39 SHA256: 284f3c17291571a83a6b3a4e219d7533476c37f6966d6f756c80798794582403 SSDeep: 96:2aWO0NGBnDWhN3BnNsff6A7QHGX1vxWiqwljkg9mRbEykP4:to6SrNNsH6KZ7w8z9mJEA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.67 KB	MD5: 2c86ee8eefa6550b406ea0e4a8d7f8cf SHA1: 7f0a419667b74dca28ebe55ac602bfa06a0dde6c SHA256: c85ebf1139281aed80904b28bf8a3aee0aa530927693b3ee8c7c3064b26cdb18 SSDeep: 48:mh5wWO/AR/JCLqgve4plAp+QIm9JNUapLukA8cPaInyBEVmfkPboB:mYpq6e4LAp+QHvSap30vny+mfkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.26 KB	MD5: ddbd204c853d2f8facfc4fbf29c60ee1 SHA1: 931b50549f71e830a505972eaf620bda83cb5e8f SHA256: b6ade5ea50f77cf700d9e7328eef0ce17118d3c94b2f66c89f60e3816ab5df65 SSDeep: 24:NwlgIxb4kaiKO6h0HdYPL6MM2LhWNSAlHDJZaXPrkvWTzT9kPbQ4iB:y+Ixb4/820HGmMfLhvAljwQ2zpkPboB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.04 KB	MD5: 731eb0c006bd7db104999c64bec6ffd5 SHA1: fa240dce18db5a2c9964a1d71ee6ba61de29116b SHA256: 90cef44bb061aa1ae7875c0bcf5779d662a0b6d1e5134936fb26da07d661484b SSDeep: 96:9kH+gGK2BBNlyss00eFcBJktYkA66D0yEFR2CgGGqjWWTgBkakP4:+H+tHNl5DcBJhy6wyCR/tWWTgB4A	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.95 KB	MD5: dfb07fab56327df3325e326d3dbd8b15 SHA1: 3350e0d2537cb658604407114d1a93ccda72bd58 SHA256: 50d4e0ab0cb53dcc9c7ab0a2d7b3ed978809464de024ef0ff84eab84e6ecbe2b SSDeep: 96:5caA8+EyAH1WZ7Npy6h5hc2Qx1Wy+n03RboicA64cZkP4:5caA5xA0ppyzDfx8UboigiA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.62 KB	MD5: 152b3936ec3452e863d98551524d5f49 SHA1: 6a7f118105c60046cb1cdea5fa8b270d8bde9c09 SHA256: dc921152d09f8950d2836f9af3da0d957179addb2944d3475a2220fac554f352 SSDeep: 48:Yhzk1MsuiPCIOQzGeUBmjmvwacvA5uVyF55HYtXJ2qkoRwgO96nIwhbHFBVkPboB:Yhzk95PtOQ3wmiwNA5ZHYtJLWgO96nII	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.90 KB	MD5: a8f0e6352cdc601e7433ba357ad8bd51 SHA1: 59d5cdcf0069d0544bec8f92de451ad12a223ec7 SHA256: 659029a5fef3d047ce91f48b4e16fbec9d9d585e67beaa86f5f901d25c6a2203 SSDeep: 48:PqJane9uR9045mK3Mp2T+eDst9qTI9AlF9BCxaty5Vl6o8DD6rD23ZY1lQbnPfM6:P/jocmK3CPeDst9qTI9uHcxN7rmglQDl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	7.25 KB	MD5: bf8ea7814fcc00453903cd3e872c8f95 SHA1: 92c3b5ada434840c4207995d8161e2787e2a0960 SHA256: 2cbd674fa71b7673ca97fdb6d295865c8abdfb2279e36b7f6456d905d7f7941e SSDeep: 192:Tbk9eQX6zVNfv6epmGorOlrcFAwlLuj31Nd+A:T4kJzV5SepsHFAw5uj3PdT	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	959.93 KB	MD5: eaf17600c31fb4067f88f2c457aa1ce5 SHA1: 4800c2ec148995435bb19edc43c43a9897ca00ee SHA256: 1c109235389826d8dc1879fde54762fdedb7706e6fc09900299f2301d73a1ca1 SSDeep: 24576:zIzaGerzNGreTT/pN8WFKp7WkW6JWc24zg4GP8EFMwp4x/:zmalrzN+eT7pN8W4pogWc24zdGP8gMIu	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[decryptyourdata@qq.com].bat	355.45 KB	MD5: a9da1d3d4a1a5eca3a0ee8c5d4ecae11 SHA1: b5b25f4eed78d642260fe947f88cffefaf07cbc0 SHA256: 374058c69de0654f48c35e7fadd0dc514c511a9063d7b55a7eed5a710b315c94 SSDeep: 6144:iCjaydVzhWUbpPKqDX6hNgXXz2QwA33IBUep6iDSFyhmMXkQRbXrv:vd5rl/ugXD/XSYTFCDDrv	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	12.73 KB	MD5: c4ae0a78e52da5b42cfbfe4510c4ff9e SHA1: 8cdedd133f3f9ce1bfea3ef789baadcff169ade6 SHA256: 88eba97fa030579757a4638df1ddbe5b04c31fa1584c9b5256f0406eb44559e2 SSDeep: 192:J+7F7zlXZqgIJnBUCXVr0Q3XGl2Kfk4apiiyN2D4TIvQL2yyaMNA:2FtXAgiHbA20qpiiPzoLGO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	14.89 KB	MD5: 450900d753922fe76e7c80ebc2e3b20c SHA1: 1069b01180bd589514d758273e3ebd8eb41081cc SHA256: 2a73d1040ec710114879e2437276e78040a029fe1142d0bc94817ef2d9bbe2f7 SSDeep: 384:mLMKZc88UeFhROIyw7v25CO4bzyTMtg4HE9VZvZThYRd8:mZZNHe3aw7u5COQWXKGVZxVYRd8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.07 KB	MD5: 1dd654bca0defdb098ca032136833601 SHA1: ea060838a854b72f16b5cc8f49856241f2c073c3 SHA256: 73fb87ceac5d6713d1f6943351a754c72cf836bd2ec25411f71b433f10ca9ec2 SSDeep: 48:DGfAm+R4LEbg58dxwsunSYS9vg2VzxF44bzF9dBLSNXjqiE+kPboB:D06yEES3w/nSYS62VNG4PFYJuiE+kP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	4.09 KB	MD5: 16cff6456243489fcb35027c72c12c92 SHA1: c123a301bac80a5ef9dff2bf35f4287cb97f226f SHA256: c8c65caf51dadbd5046037064067f4ea1086c74bc8de9f43a007efb39ed633f0 SSDeep: 96:O8BtJy0Ppda3GoIGi4yGSVAzvusJEHkC25cxV+vRRKREkP4:O8BtYYpda2OyfkvPEHuOxV4RMxA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	10.53 KB	MD5: 3bad866388595a78e54c0e6b89507a7f SHA1: f6f762484c95672b77e96f56df5be609c65c2f2a SHA256: 710477a4a0e87a743284c21165e5aa73ed178e05adae3243a17c05610f660672 SSDeep: 192:vXNxH+Q65zynFihQgjF+O5LQAIcdRr5XEgLN5AnrI8TXBQxGQpRA:v9xH+9h9QgjBdrLVZYnrICqxGQp6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.25 KB	MD5: d22e24881a58aa0b65c5925030688c34 SHA1: 2ea7c504667bb4efda327ea37fc0679d1def9681 SHA256: 1ac05c1240036aa4b57ed8df9fdffe9811486c01ad8f5406845eb3def1361849 SSDeep: 48:z4pJAl2nFVI7V66L5sDImbHTSnUuyH/amoNX/BBEJQ016Bjnn5tBF0T/kPboB:+VIx6+UQUuGvOXZCIjnnVF0T/kP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.71 KB	MD5: 243a143a16f8f0363fff3088369b68ab SHA1: 8fc0df133a0120878e857055c0336f01d5291311 SHA256: 7a3a6e19afaf37698801e9cbef9d748ef2af5d43b075213bbea090c181f50d77 SSDeep: 96:GQ71aRgQ+tU5blxn10NTAbSEw7n55sBuClRkPM:31lhtUxl3WTNEpw9E	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.61 KB	MD5: 582eded5ba56b7a1b5556c99dc381102 SHA1: 08cb6eeea5fe6da32ae6a22c1fd06b4989e8f910 SHA256: 985b4c80b9771e10b0cb58004f498152f84663e95a9121d695bfd90ee87dc15d SSDeep: 48:JNq9qURZacLEzpuMvIpJ7D/MwxYFQsOFWUPLUSzZByxXSfQK1DfHPPRoZkPboB:W9q/cLE4MvPwxYdg/osqNSIK5GZkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.45 KB	MD5: 2795274a57103e9c27f42f852e43588a SHA1: f2f591656626303a66e55297ca7a812ec0199b35 SHA256: 04687d16b70d64f34a1fc2cc288f8b906ebde191aadd03c645a41045c8e0bb19 SSDeep: 48:z1FTnTv6wrIjTaiJN1LkD2f4G7POcT9tOShFeApc21X46dkPboB:xFTnTvLIjTa2NFI23649Lpc2O6dkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[decryptyourdata@qq.com].bat	2.44 KB	MD5: 484cd337dee1e839a66f2d67b6666744 SHA1: 157f9a5cdb224993151349b2d79a2b67606903be SHA256: 7cd31e0a992fbaaa515d90f0e80d29c90688d7858e3024c6b30f5d030265d44e SSDeep: 48:kkflutXESW2r7etBOSFRThlDweMgHwX3Kk0rRgaALA23VtUxEvkPboZ:5flumSW2cBOSXMrZX330/ALA23VtUEvZ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	1.87 KB	MD5: 68805a05bba130a0f0c604f444100279 SHA1: c5c75a36255c4be83fda27b2ded92aa89da7538b SHA256: ba7deb71b88ea6bcae9fd475fe6378b778f031f1e6b5373a8a31f7761bf1215a SSDeep: 48:69X8Y/z2ZILyNJYeT2WFaEJ7XReAX6cj0mznkPboB:6Z8YEILyyeiWsEJrReAXh0mznkP4	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[decryptyourdata@qq.com].bat	48.62 KB	MD5: f1a5606f426ae58326b22b2b567a6682 SHA1: 34f43684387962431a4196756dd113eeeb90a56d SHA256: 439bf7e52f0f640fa662696a4e54da96bebc656e461374d0b5e4bb76ec0aad47 SSDeep: 1536:Um16M1rUwZz6TDAHYiU6Utd5W0hBXvGRaKK:56Mp+gH06Utd5W6KaKK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[decryptyourdata@qq.com].bat	3.13 KB	MD5: 107f300ab137ce98e87c2017e1524b85 SHA1: ec5a6c67cfcce8ecc007c8877eb9041e9d0afa73 SHA256: d6359dfb02dffdad6b8f608fcccc7aad0b81744ec50fb1b0dc1dab827c580dda SSDeep: 96:RuL61ige26xq/SG6Y/kpt57TL2a5eSaxVkP2:RuLYEo6wGt57TOSqOu	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[decryptyourdata@qq.com].bat	10.32 KB	MD5: 9f4fa07962935b0caa2e3dcf6f713f7d SHA1: 7e5114a1bc193185cc504b389a89f0d2e684f425 SHA256: 8759656190c9c737347d6a1500ef13174ad0f87710260c3403de6eb928b3d069 SSDeep: 192:bZlygW7PUG42PjT3IntclVzZS5dhhOWYkkYJhBEQbXixPeW:bZcrwG42PjstclVzM5D2wXBEGCB	... File Actions Show Properties Download

Host Behavior

File (5248)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Users\FD1HVy\Desktop\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\WINDOWS\System32\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Users\FD1HVy\Desktop\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core.mzz	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended.mzz	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\AppXManifest.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTNXT.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\hiberfil.sys	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Application.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Application.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Application.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Read	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	size = 1048560, size_out = 129	1	Fn Data
Read	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	size = 1048560, size_out = 0	1	Fn
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 144	1	Fn Data
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	size = 144	1	Fn Data
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	size = 234	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	size = 8208	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 4464	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 264	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 4144	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	size = 4784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	size = 260	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	size = 495632	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	size = 256	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	size = 242	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	size = 295264	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	size = 234	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 656	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 176	1	Fn Data
Write	C:\Program Files\desktop.ini.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 1424	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[decryptyourdata@qq.com].bat	size = 14160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 15280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 8592	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 7808	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 12256	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 176	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 4240	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 48	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[decryptyourdata@qq.com].bat	size = 105504	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[decryptyourdata@qq.com].bat	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 63936	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[decryptyourdata@qq.com].bat	size = 960	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 288	1	Fn Data
Write	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 176	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[decryptyourdata@qq.com].bat	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 145184	1	Fn Data
Write	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 786700	1	Fn Data
Write	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[decryptyourdata@qq.com].bat	size = 266	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[decryptyourdata@qq.com].bat	size = 94480	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[decryptyourdata@qq.com].bat	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 387360	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[decryptyourdata@qq.com].bat	size = 174544	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[decryptyourdata@qq.com].bat	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1536	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 800880	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[decryptyourdata@qq.com].bat	size = 36352	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 496528	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 253728	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 19456	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 763376	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 2160	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 2160	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 215888	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	2	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1048560	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 76384	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 343344	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 357360	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 65008	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 14928	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 9232	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 399536	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 3760	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 3376	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 527968	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 9840	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 262	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 384	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14880	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 786714	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2608	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10608	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3136	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 27872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3760	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[decryptyourdata@qq.com].bat	size = 16000	1	Fn Data
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 290	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 294	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 22736	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 11632	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 20688	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 284	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 27856	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 26832	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 70864	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 23248	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 286	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 396976	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3424	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4880	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 22528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16192	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26752	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 48000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 40208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 786714	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 786698	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 512224	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 263904	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 820432	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 230	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 902336	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 28960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20192	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20464	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 47792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 332976	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[decryptyourdata@qq.com].bat	size = 112	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[decryptyourdata@qq.com].bat	size = 230	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[decryptyourdata@qq.com].bat	size = 112	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13520	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10160	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 1048560	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 44704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1472	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5760	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2656	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 61040	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 250	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1520	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 786706	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 996576	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4176	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 27056	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 27568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 19488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2384	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 358624	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 390336	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2176	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1728	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8368	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4992	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4416	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3120	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1600	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1216	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 29008	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5584	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3536	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2496	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1056	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3904	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3808	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2448	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2736	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7184	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 982736	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 1048560	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[decryptyourdata@qq.com].bat	size = 363744	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	size = 590528	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12800	1	Fn
Delete	C:\588bce7c90097ed212\1053\LocalizedData.xml	-	1	Fn
Delete	C:\588bce7c90097ed212\1044\LocalizedData.xml	-	1	Fn
For performance reasons, the remaining 4011 entries are omitted. The remaining entries can be found in glog.xml.

Registry (8)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = qjhqrs.exe, data = C:\WINDOWS\System32\qjhqrs.exe, size = 60, type = REG_SZ	1	Fn

Process (1929)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0xf70, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	1902	Fn
Enumerate Processes	-	-	26	Fn

Module (135)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x75e90000	1	Fn
Load	advapi32.dll	base_address = 0x761b0000	1	Fn
Load	user32.dll	base_address = 0x74b70000	1	Fn
Load	Shell32.dll	base_address = 0x76480000	1	Fn
Load	ntdll.dll	base_address = 0x77bb0000	1	Fn
Load	mpr.dll	base_address = 0x73170000	1	Fn
Load	ws2_32.dll	base_address = 0x746a0000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x75e90000	16	Fn
Get Filename	-	process_name = c:\users\fd1hvy\desktop\qjhqrs.exe, file_name_orig = C:\Users\FD1HVy\Desktop\qjhqrs.exe, size = 32767	3	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x75efee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x75efed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x75ede500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x75efef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x75efef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x75ed32c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x75ed3780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x75efeb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x75ea6c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x75ea6c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x75ea0d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x75efdd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x75efed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x75ea6760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x75eff090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x75efed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x75efebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x75efec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x75ea6bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x75ea6bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x75efec20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x75efeab0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x75ea56c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x75ea46b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x75ea5dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x75eff100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x75eff020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x75eff180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x75efedf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x75ea57f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x75ea4590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x75efeae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x75ea4430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x75ea4410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x75ea54e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x75ea67a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x75ea5010	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x75ededc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x75edf8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x75edf750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x761ced60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x761d0540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x761cfa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x761cfc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x761e26d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x761d2380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x761e2f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x761cfc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x74b9f210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x765e4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x73172640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x73172790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x73172410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x746a5b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x746b4510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x746a5030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x746b0c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x746a5410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x746b0910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x746d6cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x746b9160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x746a49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x746a49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x746b8ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	16	Fn

Service (78)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	6	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	6	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	6	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn

System (314)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = -1 (infinite)	1	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	24	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	40	Fn
Get Time	type = Performance Ctr, time = 13340682122	1	Fn
Get Time	type = Ticks, time = 133375	3	Fn
Get Time	type = Ticks, time = 135640	2	Fn
Get Time	type = Ticks, time = 135812	2	Fn
Get Time	type = Ticks, time = 136140	2	Fn
Get Time	type = Ticks, time = 136984	4	Fn
Get Time	type = Ticks, time = 137531	2	Fn
Get Time	type = Ticks, time = 137640	2	Fn
Get Time	type = Ticks, time = 138187	4	Fn
Get Time	type = Ticks, time = 139234	4	Fn
Get Time	type = Ticks, time = 139718	2	Fn
Get Time	type = Ticks, time = 139890	2	Fn
Get Time	type = Ticks, time = 141125	4	Fn
Get Time	type = Ticks, time = 141234	2	Fn
Get Time	type = Ticks, time = 141359	2	Fn
Get Time	type = Ticks, time = 141468	2	Fn
Get Time	type = Ticks, time = 141578	2	Fn
Get Time	type = Ticks, time = 141687	2	Fn
Get Time	type = Ticks, time = 141796	2	Fn
Get Time	type = Ticks, time = 141906	2	Fn
Get Time	type = Ticks, time = 142015	2	Fn
Get Time	type = Ticks, time = 142125	2	Fn
Get Time	type = Ticks, time = 142234	4	Fn
Get Time	type = Ticks, time = 142390	2	Fn
Get Time	type = Ticks, time = 142500	2	Fn
Get Time	type = Ticks, time = 142609	2	Fn
Get Time	type = Ticks, time = 142796	2	Fn
Get Time	type = Ticks, time = 142906	2	Fn
Get Time	type = Ticks, time = 143031	2	Fn
Get Time	type = Ticks, time = 143140	2	Fn
Get Time	type = Ticks, time = 143250	4	Fn
Get Time	type = Ticks, time = 143359	2	Fn
Get Time	type = Ticks, time = 143703	2	Fn
Get Time	type = Ticks, time = 143812	2	Fn
Get Time	type = Ticks, time = 143921	2	Fn
Get Time	type = Ticks, time = 144031	2	Fn
Get Time	type = Ticks, time = 144140	2	Fn
Get Time	type = Ticks, time = 144250	2	Fn
Get Time	type = Ticks, time = 144390	4	Fn
Get Time	type = Ticks, time = 144500	2	Fn
Get Time	type = Ticks, time = 144609	2	Fn
Get Time	type = Ticks, time = 144718	2	Fn
Get Time	type = Ticks, time = 144812	2	Fn
Get Time	type = Ticks, time = 144953	2	Fn
Get Time	type = Ticks, time = 145062	2	Fn
Get Time	type = Ticks, time = 145171	2	Fn
Get Time	type = Ticks, time = 145593	4	Fn
Get Time	type = Ticks, time = 145875	2	Fn
Get Time	type = Ticks, time = 146187	2	Fn
Get Time	type = Ticks, time = 146437	2	Fn
Get Time	type = Ticks, time = 146656	4	Fn
Get Time	type = Ticks, time = 147375	2	Fn
Get Time	type = Ticks, time = 148093	4	Fn
Get Time	type = Ticks, time = 148656	2	Fn
Get Time	type = Ticks, time = 149156	4	Fn
Get Time	type = Ticks, time = 149812	2	Fn
Get Time	type = Ticks, time = 150234	4	Fn
Get Time	type = Ticks, time = 150703	2	Fn
Get Time	type = Ticks, time = 151437	4	Fn
Get Time	type = Ticks, time = 152000	2	Fn
Get Time	type = Ticks, time = 152593	4	Fn
Get Time	type = Ticks, time = 153015	2	Fn
Get Time	type = Ticks, time = 153593	2	Fn
Get Time	type = Ticks, time = 154000	4	Fn
Get Time	type = Ticks, time = 154406	2	Fn
Get Time	type = Ticks, time = 154937	2	Fn
Get Time	type = Ticks, time = 155343	4	Fn
Get Time	type = Ticks, time = 155828	2	Fn
Get Time	type = Ticks, time = 156234	2	Fn
Get Time	type = Ticks, time = 156750	4	Fn
Get Time	type = Ticks, time = 157843	4	Fn
Get Time	type = Ticks, time = 158640	2	Fn
Get Time	type = Ticks, time = 159265	4	Fn
Get Time	type = Ticks, time = 159859	2	Fn
Get Time	type = Ticks, time = 160187	2	Fn
Get Time	type = Ticks, time = 160578	4	Fn
Get Time	type = Ticks, time = 161125	2	Fn
Get Time	type = Ticks, time = 161500	2	Fn
Get Time	type = Ticks, time = 161687	4	Fn
Get Time	type = Ticks, time = 161984	2	Fn
Get Time	type = Ticks, time = 162390	2	Fn
Get Time	type = Ticks, time = 162828	4	Fn
Get Time	type = Ticks, time = 163046	2	Fn
Get Time	type = Ticks, time = 163468	2	Fn
Get Time	type = Ticks, time = 163906	4	Fn
Get Time	type = Ticks, time = 164046	1	Fn
Get Time	type = Ticks, time = 164062	1	Fn
Get Time	type = Ticks, time = 164921	4	Fn
Get Time	type = Ticks, time = 165640	2	Fn
Get Time	type = Ticks, time = 165984	4	Fn
Get Time	type = Ticks, time = 166421	2	Fn
Get Time	type = Ticks, time = 167171	4	Fn
Get Time	type = Ticks, time = 167718	2	Fn
Get Time	type = Ticks, time = 168031	2	Fn
Get Time	type = Ticks, time = 168171	2	Fn
Get Time	type = Ticks, time = 168281	4	Fn
Get Time	type = Ticks, time = 168515	2	Fn
Get Info	type = Operating System	2	Fn

Mutex (4)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\syncronize_FV4I9QA	1	Fn
Create	mutex_name = Global\syncronize_FV4I9QU	1	Fn
Open	mutex_name = Global\syncronize_FV4I9QA, desired_access = SYNCHRONIZE	1	Fn
Open	mutex_name = Global\syncronize_FV4I9QU, desired_access = SYNCHRONIZE	1	Fn

Process #2: cmd.exe

143

Information	Value
ID	#2
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:00:42, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:02:32

OS Process Information

Information	Value
PID	0xf70
Parent PID	0x8f4 (c:\users\fd1hvy\desktop\qjhqrs.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 4C4 0x D48

Host Behavior

File (94)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\Users\FD1HVy\Desktop	type = file_attributes	2	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	8	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	3	Fn
Open	STD_OUTPUT_HANDLE	-	19	Fn
Open	STD_INPUT_HANDLE	-	31	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	24	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	2	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (2)

Operation	Process	Additional Information	Success	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0xcac, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL		1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION		1	Fn

Memory (1)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 480017281024, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ff931f40000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff60d860000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ff92fdd0000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ff92fdea990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ff92fdee830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ff92fdee300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (16)

Operation	Additional Information	Count	Logfile
Get Environment String	-	5	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	2	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	2	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Set Environment String	name = COPYCMD	1	Fn

Process #4: mode.com

Information	Value
ID	#4
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:08, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:02:06
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xcac
Parent PID	0xf70 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 6C8 0x 6CC 0x E44

Process #5: qjhqrs.exe

14761

Information	Value
ID	#5
File Name	c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe
Command Line	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:16, Reason: Autostart
Unmonitor	End Time: 00:02:52, Reason: Self Terminated
Monitor Duration	00:00:35

OS Process Information

Information	Value
PID	0xdec
Parent PID	0x7e4 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DF0 0x DF4 0x E00 0x E04 0x E08 0x E0C 0x E10 0x E1C 0x E24 0x E28 0x E2C 0x E30 0x E34 0x E38 0x E3C 0x E40 0x E44 0x E48 0x E68 0x E6C 0x E94 0x E98 0x E9C 0x EA0

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
qjhqrs.exe	0x00400000	0x00418FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump
qjhqrs.exe	0x00400000	0x00418FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Host Behavior

File (1566)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\WINDOWS\System32\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107328.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SCHOL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SHOW_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPACE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPRNG_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SUMER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SWEST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\URBAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\VCTRN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\WNTER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ROAD_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8-RT-KB2999226-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8-RT-KB2999226-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8.1-KB2999226-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8.1-KB2999226-x86.msu.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171685.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172035.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172193.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174635.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174639.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174952.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175428.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177257.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177806.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178348.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178459.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178460.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178523.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178632.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178639.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178932.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0179963.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182689.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182888.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182902.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182946.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174315.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183198.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183574.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185670.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185774.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185776.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185778.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185780.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185786.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185790.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185796.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185798.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185800.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185806.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185818.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185828.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185834.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185842.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186346.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186360.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186362.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187647.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183172.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187817.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187819.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187825.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187829.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187835.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187837.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187839.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187849.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187851.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187859.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187863.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187881.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187883.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187893.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187895.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187921.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188511.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188513.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188519.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188587.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188667.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188669.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187815.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183174.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195248.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195260.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195320.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195428.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195772.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195788.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196060.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196110.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196142.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196354.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197979.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197983.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198016.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198020.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198021.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198022.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198025.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198102.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188679.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198226.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198234.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198372.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198377.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198447.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198494.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0198712.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199279.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199303.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199307.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199423.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199429.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199465.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199469.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199473.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199475.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199483.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0199609.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200151.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200163.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200183.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200189.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200273.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200279.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200289.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200377.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200383.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200467.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200521.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0200611.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0202045.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0211981.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0212299.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0212601.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0212685.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0212751.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0212953.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0213243.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0213449.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0214934.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0214948.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215070.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215076.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215210.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215709.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215710.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0215718.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216112.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216153.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216540.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216570.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216612.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216874.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0217262.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0217302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0217872.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0227419.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0227558.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0228823.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0228959.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
For performance reasons, the remaining 564 entries are omitted. The remaining entries can be found in glog.xml.

Registry (10)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = qjhqrs.exe, data = 6115272, size = 84, type = REG_SZ	1	Fn
Write Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	value_name = qjhqrs.exe, data = C:\Users\FD1HVy\AppData\Roaming\qjhqrs.exe, size = 84, type = REG_SZ	1	Fn

Process (1322)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0xdf8, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0xfc8, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	1290	Fn
Enumerate Processes	-	-	29	Fn

Module (164)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x76550000	1	Fn
Load	advapi32.dll	base_address = 0x76b10000	1	Fn
Load	user32.dll	base_address = 0x770d0000	1	Fn
Load	Shell32.dll	base_address = 0x74970000	1	Fn
Load	ntdll.dll	base_address = 0x77220000	1	Fn
Load	mpr.dll	base_address = 0x73c20000	1	Fn
Load	ws2_32.dll	base_address = 0x76cb0000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x76550000	30	Fn
Get Filename	-	process_name = c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe, size = 32767	4	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x765651b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x765650d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x765bee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x765bed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7659e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x765bef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x76565090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x765bef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x76563cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x76564cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x765932c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x76593780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x765beb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x76566c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x76566c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x765bea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x765beca0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x76560d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x765bdd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x765bed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x76566b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x765bebb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x76566760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x7726b250	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x765bf090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x765bed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x765bebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x7726b2d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x765bec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x76566bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x76566bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x7724fb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x765bec20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x765beab0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x765656c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x765646b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x76564a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x76565da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x76565dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x765bea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x765bf100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x765bf020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x765bf180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x765bf130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x765bf0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x765bedf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x765651f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x7725f630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77262dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x765657f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x76564590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x765beae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x76564610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x76564430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x76564410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x76565cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x765667e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x765654e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x765667a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x76565010	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7659edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7659f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7659f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x76b2e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x76b2e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x76b2f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x76b2ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x76b2efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x76b2ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x76b30540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x76b2fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x76b2fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x76b426d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x76b32380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x76b42f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x76b2fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x770ff210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x74ad4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77292070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x73c22640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x73c22790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x73c22410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x76cb5b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x76cc4510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x76cb5030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x76cc0c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x76cb5410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x76cc0910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x76ce6cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x76cc9160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x76cc8ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x76566b30	30	Fn

Service (87)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	9	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	9	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	9	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn

System (400)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = -1 (infinite)	3	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	30	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	103	Fn
Get Time	type = Performance Ctr, time = 6165866967	1	Fn
Get Time	type = Ticks, time = 61625	3	Fn
Get Time	type = Ticks, time = 62531	2	Fn
Get Time	type = Ticks, time = 63000	2	Fn
Get Time	type = Ticks, time = 63328	2	Fn
Get Time	type = Ticks, time = 64312	4	Fn
Get Time	type = Ticks, time = 64671	2	Fn
Get Time	type = Ticks, time = 65062	2	Fn
Get Time	type = Ticks, time = 65265	2	Fn
Get Time	type = Ticks, time = 65531	4	Fn
Get Time	type = Ticks, time = 65843	2	Fn
Get Time	type = Ticks, time = 66359	2	Fn
Get Time	type = Ticks, time = 66687	4	Fn
Get Time	type = Ticks, time = 67078	2	Fn
Get Time	type = Ticks, time = 67531	2	Fn
Get Time	type = Ticks, time = 67750	4	Fn
Get Time	type = Ticks, time = 68125	2	Fn
Get Time	type = Ticks, time = 68515	2	Fn
Get Time	type = Ticks, time = 68734	2	Fn
Get Time	type = Ticks, time = 68953	4	Fn
Get Time	type = Ticks, time = 69062	2	Fn
Get Time	type = Ticks, time = 69171	2	Fn
Get Time	type = Ticks, time = 69281	2	Fn
Get Time	type = Ticks, time = 69390	2	Fn
Get Time	type = Ticks, time = 69593	2	Fn
Get Time	type = Ticks, time = 69718	2	Fn
Get Time	type = Ticks, time = 69890	2	Fn
Get Time	type = Ticks, time = 70046	4	Fn
Get Time	type = Ticks, time = 70203	2	Fn
Get Time	type = Ticks, time = 70406	2	Fn
Get Time	type = Ticks, time = 70984	2	Fn
Get Time	type = Ticks, time = 71109	4	Fn
Get Time	type = Ticks, time = 71328	2	Fn
Get Time	type = Ticks, time = 71859	2	Fn
Get Time	type = Ticks, time = 72171	2	Fn
Get Time	type = Ticks, time = 72187	2	Fn
Get Time	type = Ticks, time = 72312	2	Fn
Get Time	type = Ticks, time = 72437	2	Fn
Get Time	type = Ticks, time = 72812	2	Fn
Get Time	type = Ticks, time = 73078	2	Fn
Get Time	type = Ticks, time = 73281	4	Fn
Get Time	type = Ticks, time = 73468	2	Fn
Get Time	type = Ticks, time = 73625	2	Fn
Get Time	type = Ticks, time = 73765	2	Fn
Get Time	type = Ticks, time = 73953	2	Fn
Get Time	type = Ticks, time = 74109	2	Fn
Get Time	type = Ticks, time = 74515	4	Fn
Get Time	type = Ticks, time = 74640	2	Fn
Get Time	type = Ticks, time = 74984	2	Fn
Get Time	type = Ticks, time = 75109	2	Fn
Get Time	type = Ticks, time = 76093	4	Fn
Get Time	type = Ticks, time = 76640	1	Fn
Get Time	type = Ticks, time = 76656	1	Fn
Get Time	type = Ticks, time = 76828	2	Fn
Get Time	type = Ticks, time = 77046	2	Fn
Get Time	type = Ticks, time = 77343	4	Fn
Get Time	type = Ticks, time = 77546	2	Fn
Get Time	type = Ticks, time = 77718	2	Fn
Get Time	type = Ticks, time = 77921	2	Fn
Get Time	type = Ticks, time = 78250	2	Fn
Get Time	type = Ticks, time = 78875	4	Fn
Get Time	type = Ticks, time = 79359	2	Fn
Get Time	type = Ticks, time = 79531	2	Fn
Get Time	type = Ticks, time = 79671	2	Fn
Get Time	type = Ticks, time = 79781	2	Fn
Get Time	type = Ticks, time = 80078	4	Fn
Get Time	type = Ticks, time = 80187	1	Fn
Get Time	type = Ticks, time = 80234	1	Fn
Get Time	type = Ticks, time = 80343	1	Fn
Get Time	type = Ticks, time = 80359	1	Fn
Get Time	type = Ticks, time = 80515	2	Fn
Get Time	type = Ticks, time = 80671	2	Fn
Get Time	type = Ticks, time = 80828	2	Fn
Get Time	type = Ticks, time = 81218	4	Fn
Get Time	type = Ticks, time = 81500	2	Fn
Get Time	type = Ticks, time = 81875	2	Fn
Get Time	type = Ticks, time = 82515	4	Fn
Get Time	type = Ticks, time = 82906	2	Fn
Get Time	type = Ticks, time = 83296	2	Fn
Get Time	type = Ticks, time = 83609	4	Fn
Get Time	type = Ticks, time = 83828	2	Fn
Get Time	type = Ticks, time = 84000	2	Fn
Get Time	type = Ticks, time = 84234	2	Fn
Get Time	type = Ticks, time = 84421	2	Fn
Get Time	type = Ticks, time = 84562	2	Fn
Get Time	type = Ticks, time = 84812	4	Fn
Get Time	type = Ticks, time = 84968	2	Fn
Get Time	type = Ticks, time = 85140	2	Fn
Get Time	type = Ticks, time = 85500	2	Fn
Get Time	type = Ticks, time = 85765	2	Fn
Get Time	type = Ticks, time = 85953	4	Fn
Get Time	type = Ticks, time = 86296	2	Fn
Get Time	type = Ticks, time = 86578	2	Fn
Get Time	type = Ticks, time = 86718	2	Fn
Get Time	type = Ticks, time = 87031	4	Fn
Get Time	type = Ticks, time = 87312	2	Fn
Get Time	type = Ticks, time = 87468	2	Fn
Get Time	type = Ticks, time = 87625	2	Fn
Get Time	type = Ticks, time = 87781	2	Fn
Get Time	type = Ticks, time = 87937	2	Fn
Get Time	type = Ticks, time = 88171	4	Fn
Get Time	type = Ticks, time = 88343	2	Fn
Get Time	type = Ticks, time = 88453	2	Fn
Get Time	type = Ticks, time = 88609	2	Fn
Get Time	type = Ticks, time = 88890	2	Fn
Get Time	type = Ticks, time = 89125	2	Fn
Get Time	type = Ticks, time = 89453	4	Fn
Get Time	type = Ticks, time = 89750	2	Fn
Get Time	type = Ticks, time = 89906	2	Fn
Get Time	type = Ticks, time = 90078	2	Fn
Get Time	type = Ticks, time = 91031	4	Fn
Get Time	type = Ticks, time = 91250	1	Fn
Get Info	type = Operating System	2	Fn

Mutex (6)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\syncronize_FV4I9QA	1	Fn
Create	mutex_name = Global\syncronize_FV4I9QU	1	Fn
Open	mutex_name = Global\syncronize_FV4I9QA, desired_access = SYNCHRONIZE	1	Fn
Open	mutex_name = Global\syncronize_FV4I9QU, desired_access = SYNCHRONIZE	1	Fn
Release	mutex_name = Global\syncronize_FV4I9QA	2	Fn

Process #6: cmd.exe

284

Information	Value
ID	#6
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:21, Reason: Child Process
Unmonitor	End Time: 00:02:45, Reason: Self Terminated
Monitor Duration	00:00:23

OS Process Information

Information	Value
PID	0xdf8
Parent PID	0xdec (c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DFC 0x E70

Host Behavior

File (218)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	14	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	7	Fn
Open	STD_OUTPUT_HANDLE	-	36	Fn
Open	STD_INPUT_HANDLE	-	81	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	65	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	5	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 20	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 36	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 5	1	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (4)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0xe84, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\vssadmin.exe	os_pid = 0xec0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION	1	Fn
Get Info	C:\WINDOWS\system32\vssadmin.exe	type = PROCESS_BASIC_INFORMATION	1	Fn

Memory (2)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 988777336832, size = 1952		1	Fn Data
Read	C:\WINDOWS\system32\vssadmin.exe	address = 584165670912, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ff851550000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff6e2e30000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ff850fa0000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ff850fba990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ff850fbe830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ff850fbe300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ff84e410a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ff8515f56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (30)

Operation	Additional Information	Count	Logfile
Get Environment String	-	10	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps;	3	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	3	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn
Set Environment String	name = COPYCMD	2	Fn
Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Set Environment String	name = =ExitCodeAscii	2	Fn
Set Environment String	name = =ExitCode, value = 00000002	1	Fn

Process #8: qjhqrs.exe

111

Information	Value
ID	#8
File Name	c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\qjhqrs.exe
Command Line	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:27, Reason: Autostart
Unmonitor	End Time: 00:02:30, Reason: Self Terminated
Monitor Duration	00:00:02

OS Process Information

Information	Value
PID	0xe74
Parent PID	0x7e4 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E78 0x EA4

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
qjhqrs.exe	0x00400000	0x00418FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Host Behavior

Module (100)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x76550000	1	Fn
Load	advapi32.dll	base_address = 0x76b10000	1	Fn
Load	user32.dll	base_address = 0x770d0000	1	Fn
Load	Shell32.dll	base_address = 0x74970000	1	Fn
Load	ntdll.dll	base_address = 0x77220000	1	Fn
Load	mpr.dll	base_address = 0x73c20000	1	Fn
Load	ws2_32.dll	base_address = 0x76cb0000	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x765651b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x765650d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x765bee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x765bed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7659e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x765bef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x76565090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x765bef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x76563cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x76564cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x765932c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x76593780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x765beb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x76566c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x76566c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x765bea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x765beca0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x76560d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x765bdd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x765bed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x76566b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x765bebb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x76566760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x7726b250	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x765bf090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x765bed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x765bebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x7726b2d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x765bec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x76566bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x76566bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x7724fb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x765bec20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x765beab0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x765656c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x765646b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x76564a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x76565da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x76565dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x765bea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x765bf100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x765bf020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x765bf180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x765bf130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x765bf0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x765bedf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x765651f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x7725f630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77262dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x765657f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x76564590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x765beae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x76564610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x76564430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x76564410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x76565cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x765667e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x765654e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x765667a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x76565010	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7659edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7659f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7659f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x76b2e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x76b2e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x76b2f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x76b2ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x76b2efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x76b2ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x76b30540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x76b2fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x76b2fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x76b426d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x76b32380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x76b42f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x76b2fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x770ff210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x74ad4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77292070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x73c22640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x73c22790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x73c22410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x76cb5b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x76cc4510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x76cb5030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x76cc0c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x76cb5410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x76cc0910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x76ce6cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x76cc9160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x76cc8ff0	1	Fn

System (6)

Operation	Additional Information	Count	Logfile
Get Time	type = Performance Ctr, time = 6994126431	1	Fn
Get Time	type = Ticks, time = 69906	3	Fn
Get Info	type = Operating System	2	Fn

Mutex (2)

Operation	Additional Information	Success	Count	Logfile
Open	mutex_name = Global\syncronize_FV4I9QA, desired_access = SYNCHRONIZE		1	Fn
Open	mutex_name = Global\syncronize_FV4I9QU, desired_access = SYNCHRONIZE		1	Fn

Process #9: mode.com

Information	Value
ID	#9
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:28, Reason: Child Process
Unmonitor	End Time: 00:02:33, Reason: Self Terminated
Monitor Duration	00:00:05
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xe84
Parent PID	0xdf8 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E88 0x E8C 0x E90

Process #11: vssadmin.exe

Information	Value
ID	#11
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:34, Reason: Child Process
Unmonitor	End Time: 00:02:41, Reason: Self Terminated
Monitor Duration	00:00:07
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xec0
Parent PID	0xdf8 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x EC4 0x ECC 0x EEC 0x F00 0x F04

Process #12: qjhqrs.exe

29939

Information	Value
ID	#12
File Name	c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe
Command Line	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe" -a
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:48, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:00:26

OS Process Information

Information	Value
PID	0xfbc
Parent PID	0xdec (c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FC0 0x FC4 0x FE8 0x FEC 0x FF0 0x FF4 0x C1C 0x 760 0x C20 0x C24 0x 2AC 0x 38C 0x 6A4 0x 9C4 0x 6A0 0x 498 0x 488

Host Behavior

File (4431)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\WINDOWS\System32\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\kor_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgun_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgun_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryon_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryon_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryo_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryo_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjhn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjhn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjh_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjh_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-HK\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-HK\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-HK\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-HK\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-TW\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-TW\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-TW\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\zh-TW\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\hiberfil.sys	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\pagefile.sys	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\kw_necklace.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msader15.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msader15.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado15.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado15.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado20.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado20.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado21.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado21.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado25.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado25.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\arrived.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\meta-index	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\meta-index	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\net.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\net.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\resources.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\resources.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\rt.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\rt.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\trusted.libraries	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\LICENSE	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\LICENSE	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\release	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\release	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\governments.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\governments.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\governments.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l2-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l2-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-localization-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-localization-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-processthreads-l1-1-1.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-processthreads-l1-1-1.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-synch-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-synch-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-timezone-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-timezone-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-xstate-l2-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-xstate-l2-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-conio-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-conio-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-convert-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-convert-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-environment-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-environment-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-heap-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-heap-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107328.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-locale-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-locale-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107328.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107328.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-private-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-private-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-process-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-process-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-runtime-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-runtime-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-stdio-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-stdio-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-string-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-string-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-time-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-time-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-utility-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-utility-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate32.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate32.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate32.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate64.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate64.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate64.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvStream32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvStream64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvStream64.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvSubsystems32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvSubsystems64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppvIsvSubsystems64.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVLP.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVLP.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\AppVLP.exe.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\C2R32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\C2R64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\C2R64.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\concrt140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\concrt140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\mfc140u.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\mfc140u.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp120.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp120.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp120.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcr120.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcp140.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcr120.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\msvcr120.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\ucrtbase.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\ucrtbase.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vccorlib140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vccorlib140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vcruntime140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vcruntime140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\client\vcruntime140.dll.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF.id-B4197730.[decryptyourdata@qq.com].bat	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171685.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171685.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Write	C:\Program Files\Common Files\kw_necklace.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 75792	1	Fn Data
Write	C:\Program Files\Common Files\kw_necklace.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Java\arrived.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 75792	1	Fn Data
Write	C:\Program Files\Java\arrived.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 698240	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 254	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 1296	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 248	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 64	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 13968	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 116448	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 944176	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[decryptyourdata@qq.com].bat	size = 20112	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[decryptyourdata@qq.com].bat	size = 20080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 33936	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4160	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 234080	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 260	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 560592	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 2464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 248	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 584592	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 242704	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[decryptyourdata@qq.com].bat	size = 266	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[decryptyourdata@qq.com].bat	size = 4000	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 384	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[decryptyourdata@qq.com].bat	size = 2864	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[decryptyourdata@qq.com].bat	size = 266	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 14640	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 254	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[decryptyourdata@qq.com].bat	size = 2128	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 31824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 4480	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[decryptyourdata@qq.com].bat	size = 2800	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 10400	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 786688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 21552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\resources.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 786694	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\resources.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[decryptyourdata@qq.com].bat	size = 3392	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\rt.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 786680	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\rt.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 23552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[decryptyourdata@qq.com].bat	size = 4064	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[decryptyourdata@qq.com].bat	size = 230	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[decryptyourdata@qq.com].bat	size = 1264	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 19616	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2160	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3344	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[decryptyourdata@qq.com].bat	size = 114928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3024	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[decryptyourdata@qq.com].bat	size = 2480	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[decryptyourdata@qq.com].bat	size = 36528	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[decryptyourdata@qq.com].bat	size = 112	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 27088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 3040	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 252	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 3536	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 48384	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 1216	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[decryptyourdata@qq.com].bat	size = 48	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[decryptyourdata@qq.com].bat	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[decryptyourdata@qq.com].bat	size = 544	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[decryptyourdata@qq.com].bat	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[decryptyourdata@qq.com].bat	size = 8416	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 48400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[decryptyourdata@qq.com].bat	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.id-B4197730.[decryptyourdata@qq.com].bat	size = 27216	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13472	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 22544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 22304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 290	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 294	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20224	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11120	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13440	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 11632	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2464	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10864	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 20688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 22736	1	Fn Data
Write	C:\Program Files\Microsoft Office\governments.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 75792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11296	1	Fn Data
Write	C:\Program Files\Microsoft Office\governments.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 6544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 26832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 284	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 70864	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 23680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 27856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 21232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 23248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9616	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate32.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 215776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate32.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate64.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 255200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVDllSurrogate64.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8016	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6864	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8880	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16480	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14016	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 286	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVLP.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 431680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 332976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 30352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\mfc140u.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 786690	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7952	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\AppVLP.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 40240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 33664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 61648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 21136	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 17872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 31856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 36832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 36800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 33968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 39552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 46512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 49248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 43680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 38240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 27408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 35424	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 46416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 67552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 64816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\mfc140u.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15472	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcp120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 660144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcp120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10944	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6288	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9616	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 30816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152690.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 34688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152688.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1952	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7888	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10672	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcp140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 635056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcp140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcr120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 963248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\msvcr120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 982736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 390336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1920	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 9328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\vcruntime140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 88768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\client\vcruntime140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 7392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 33072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6176	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 4848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 10576	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153265.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 12992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 30816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 36624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 7568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 38496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 7184	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 8576	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17520	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153398.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 9328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 9808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7440	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153516.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 34272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153508.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153518.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153514.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 46704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157167.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 1392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0156537.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17920	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157191.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157831.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18656	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158071.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 21728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0157177.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6656	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 46496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0158477.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 8544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 29408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0160590.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171685.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14480	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0171685.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 7776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172035.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172035.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0168644.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6576	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172067.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 7360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174315.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174315.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ROAD_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ROAD_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 10128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174639.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174639.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SCHOL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SCHOL_02.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 5408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SHOW_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SHOW_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 46464	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175361.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPACE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 4224	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPACE_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175428.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 14560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175428.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SUMER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 14048	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SUMER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPRNG_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPRNG_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SWEST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 8512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SWEST_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\URBAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 13360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\URBAN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\WNTER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 6928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\WNTER_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 47856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 340224	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\VCTRN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 4976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\VCTRN_01.MID.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172193.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0172193.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177806.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 55568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177806.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx	size = 334144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx	size = 248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178348.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 36992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178348.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 335040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174952.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 24992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174952.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 352784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 54352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174635.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174635.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178460.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 26544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178460.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 46416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 44976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 45232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 258	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 295088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177257.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 45360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177257.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178459.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 29216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178459.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 186208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 48368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 290	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 294	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 45440	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 56960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178932.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 35344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178932.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178523.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 24048	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178523.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178639.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 32048	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178639.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178632.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 23344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178632.JPG.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 22736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 286	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182898.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 18640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 11632	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182902.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182902.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182888.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182888.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183172.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 29792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183172.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 73424	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183174.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 28640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183174.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182946.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16096	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182946.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 29392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 26832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183574.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 19280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183574.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183198.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0183198.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 20688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 284	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 23248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 21200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185774.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20048	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185774.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185670.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185670.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-utility-l1-1-0.dll	size = 32112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-utility-l1-1-0.dll	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVFileSystemMetadata.dll	size = 16624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVFileSystemMetadata.dll	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVFileSystemMetadata.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 259808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVFileSystemMetadata.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185776.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 27104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185776.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVManifest.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 1007328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVManifest.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 19152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185780.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 59744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185780.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185786.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 39344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185786.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185778.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 25328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185778.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	size = 560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	size = 268	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185790.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 20672	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185790.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185796.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 25872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185796.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185798.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 33840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185798.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 578272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185800.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 24240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185806.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 30528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	size = 720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVStreamMap.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 194784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185818.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 35728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185828.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 786706	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 243536	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\concrt140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185828.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185818.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVStreamMap.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 246	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.manifest.id-B4197730.[decryptyourdata@qq.com].bat	size = 264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185806.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185800.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186360.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 33856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Eventing.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 96480	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 363744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 49376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Flattener.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 45680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185842.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 14320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186346.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8672	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185834.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186346.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185842.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Flattener.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 284	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 284	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0185834.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Eventing.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 266	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186360.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187815.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187647.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6608	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18224	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.BinaryStore.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 73328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186362.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 17664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 31344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 286	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 786748	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187647.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.BinaryStore.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0186362.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187815.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187817.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 11648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187817.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcp140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 439616	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcp140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 132816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187829.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187825.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187819.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187835.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187835.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 290	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcr120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 968896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcp120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 455360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcp120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 900304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\ucrtbase.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187819.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187825.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187829.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 266944	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\vccorlib140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187837.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187837.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187849.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187849.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7120	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187847.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\vcruntime140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 85344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\vcruntime140.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187839.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187839.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Flattener\msvcr120.dll.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187851.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187851.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187863.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187863.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187859.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187859.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.id-B4197730.[decryptyourdata@qq.com].bat	size = 45072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.id-B4197730.[decryptyourdata@qq.com].bat	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 9120	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187861.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187883.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 2112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187883.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187881.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187881.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 1048560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187893.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5632	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187893.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 181392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.id-B4197730.[decryptyourdata@qq.com].bat	size = 786694	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\OneDriveSetup.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 786702	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\OneDriveSetup.exe.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187895.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187895.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187921.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0187921.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188511.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 10720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188511.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188513.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 12304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188513.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188587.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 15200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188587.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188667.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 16032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188667.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\QFE31928.msp.id-B4197730.[decryptyourdata@qq.com].bat	size = 786692	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\QFE31928.msp.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\QFE31927.msp.id-B4197730.[decryptyourdata@qq.com].bat	size = 786692	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\QFE31927.msp.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	2	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\QFE31927.msp.id-B4197730.[decryptyourdata@qq.com].bat	size = 262144	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188519.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188519.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188669.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 29616	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188669.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188679.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0188679.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.id-B4197730.[decryptyourdata@qq.com].bat	size = 786694	1	Fn
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195248.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 7344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195248.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195254.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 21344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195342.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195320.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 29440	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195320.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195260.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 8320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195260.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195428.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 18624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195428.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195772.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195772.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196110.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196110.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196142.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196142.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196354.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 13712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196354.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195788.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 3008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0195788.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196060.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 4752	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196060.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	size = 1026432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x64.msu.id-B4197730.[decryptyourdata@qq.com].bat	size = 268	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 6928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196358.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197983.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 26256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197983.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197979.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 40240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0197979.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 5712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0196364.WMF.id-B4197730.[decryptyourdata@qq.com].bat	size = 236	1	Fn Data
For performance reasons, the remaining 3325 entries are omitted. The remaining entries can be found in glog.xml.

Registry (8)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = qjhqrs.exe, data = C:\WINDOWS\System32\qjhqrs.exe, size = 60, type = REG_SZ	1	Fn

Process (1206)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0xfe0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	1179	Fn
Enumerate Processes	-	-	26	Fn

Module (135)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x76550000	1	Fn
Load	advapi32.dll	base_address = 0x76b10000	1	Fn
Load	user32.dll	base_address = 0x770d0000	1	Fn
Load	Shell32.dll	base_address = 0x74970000	1	Fn
Load	ntdll.dll	base_address = 0x77220000	1	Fn
Load	mpr.dll	base_address = 0x73c20000	1	Fn
Load	ws2_32.dll	base_address = 0x76cb0000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x76550000	16	Fn
Get Filename	-	process_name = c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qjhqrs.exe, size = 32767	3	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x765651b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x765650d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x765bee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x765bed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7659e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x765bef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x76565090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x765bef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x76563cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x76564cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x765932c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x76593780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x765beb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x76566c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x76566c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x765bea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x765beca0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x76560d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x765bdd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x765bed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x76566b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x765bebb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x76566760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x7726b250	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x765bf090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x765bed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x765bebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x7726b2d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x765bec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x76566bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x76566bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x7724fb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x765bec20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x765beab0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x765656c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x765646b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x76564a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x76565da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x76565dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x765bea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x765bf100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x765bf020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x765bf180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x765bf130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x765bf0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x765bedf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x765651f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x7725f630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77262dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x765657f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x76564590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x765beae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x76564610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x76564430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x76564410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x76565cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x765667e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x765654e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x765667a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x76565010	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7659edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7659f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7659f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x76b2e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x76b2e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x76b2f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x76b2ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x76b2efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x76b2ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x76b30540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x76b2fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x76b2fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x76b426d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x76b32380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x76b42f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x76b2fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x770ff210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x74ad4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77292070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x73c22640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x73c22790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x73c22410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x76cb5b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x76cc4510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x76cb5030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x76cc0c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x76cb5410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x76cc0910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x76ce6cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x76cc9160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x76cb49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x76cc8ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x76566b30	16	Fn

Service (81)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	10	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	10	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	10	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn

System (352)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = -1 (infinite)	1	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	60	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	25	Fn
Get Time	type = Performance Ctr, time = 8999950837	1	Fn
Get Time	type = Ticks, time = 89968	3	Fn
Get Time	type = Ticks, time = 92218	1	Fn
Get Time	type = Ticks, time = 92406	1	Fn
Get Time	type = Ticks, time = 92437	1	Fn
Get Time	type = Ticks, time = 92734	1	Fn
Get Time	type = Ticks, time = 92765	1	Fn
Get Time	type = Ticks, time = 93031	2	Fn
Get Time	type = Ticks, time = 93484	4	Fn
Get Time	type = Ticks, time = 93812	2	Fn
Get Time	type = Ticks, time = 94140	2	Fn
Get Time	type = Ticks, time = 94593	4	Fn
Get Time	type = Ticks, time = 95781	4	Fn
Get Time	type = Ticks, time = 96140	2	Fn
Get Time	type = Ticks, time = 96906	4	Fn
Get Time	type = Ticks, time = 97578	2	Fn
Get Time	type = Ticks, time = 97890	2	Fn
Get Time	type = Ticks, time = 98234	4	Fn
Get Time	type = Ticks, time = 98562	2	Fn
Get Time	type = Ticks, time = 99125	2	Fn
Get Time	type = Ticks, time = 99484	4	Fn
Get Time	type = Ticks, time = 99687	2	Fn
Get Time	type = Ticks, time = 99890	2	Fn
Get Time	type = Ticks, time = 100109	2	Fn
Get Time	type = Ticks, time = 100296	2	Fn
Get Time	type = Ticks, time = 100484	2	Fn
Get Time	type = Ticks, time = 100671	4	Fn
Get Time	type = Ticks, time = 100906	2	Fn
Get Time	type = Ticks, time = 101093	2	Fn
Get Time	type = Ticks, time = 101218	2	Fn
Get Time	type = Ticks, time = 101375	2	Fn
Get Time	type = Ticks, time = 101515	2	Fn
Get Time	type = Ticks, time = 102125	4	Fn
Get Time	type = Ticks, time = 102640	2	Fn
Get Time	type = Ticks, time = 102843	2	Fn
Get Time	type = Ticks, time = 103265	4	Fn
Get Time	type = Ticks, time = 103390	2	Fn
Get Time	type = Ticks, time = 103562	2	Fn
Get Time	type = Ticks, time = 103703	2	Fn
Get Time	type = Ticks, time = 103812	2	Fn
Get Time	type = Ticks, time = 103921	2	Fn
Get Time	type = Ticks, time = 104031	2	Fn
Get Time	type = Ticks, time = 104140	2	Fn
Get Time	type = Ticks, time = 104250	2	Fn
Get Time	type = Ticks, time = 104375	4	Fn
Get Time	type = Ticks, time = 104484	2	Fn
Get Time	type = Ticks, time = 104593	2	Fn
Get Time	type = Ticks, time = 104703	2	Fn
Get Time	type = Ticks, time = 104812	2	Fn
Get Time	type = Ticks, time = 104953	2	Fn
Get Time	type = Ticks, time = 105062	2	Fn
Get Time	type = Ticks, time = 105171	2	Fn
Get Time	type = Ticks, time = 105281	2	Fn
Get Time	type = Ticks, time = 105390	4	Fn
Get Time	type = Ticks, time = 105531	2	Fn
Get Time	type = Ticks, time = 105640	2	Fn
Get Time	type = Ticks, time = 105750	2	Fn
Get Time	type = Ticks, time = 105859	2	Fn
Get Time	type = Ticks, time = 105968	2	Fn
Get Time	type = Ticks, time = 106093	2	Fn
Get Time	type = Ticks, time = 106218	2	Fn
Get Time	type = Ticks, time = 106328	2	Fn
Get Time	type = Ticks, time = 106437	4	Fn
Get Time	type = Ticks, time = 106546	2	Fn
Get Time	type = Ticks, time = 106671	2	Fn
Get Time	type = Ticks, time = 106765	2	Fn
Get Time	type = Ticks, time = 106875	2	Fn
Get Time	type = Ticks, time = 106984	2	Fn
Get Time	type = Ticks, time = 107093	2	Fn
Get Time	type = Ticks, time = 107234	2	Fn
Get Time	type = Ticks, time = 107359	2	Fn
Get Time	type = Ticks, time = 107468	4	Fn
Get Time	type = Ticks, time = 107578	2	Fn
Get Time	type = Ticks, time = 107687	2	Fn
Get Time	type = Ticks, time = 107796	2	Fn
Get Time	type = Ticks, time = 107906	2	Fn
Get Time	type = Ticks, time = 108015	2	Fn
Get Time	type = Ticks, time = 108125	2	Fn
Get Time	type = Ticks, time = 108234	2	Fn
Get Time	type = Ticks, time = 108343	2	Fn
Get Time	type = Ticks, time = 108453	2	Fn
Get Time	type = Ticks, time = 110828	4	Fn
Get Time	type = Ticks, time = 111015	2	Fn
Get Time	type = Ticks, time = 111125	2	Fn
Get Time	type = Ticks, time = 111234	2	Fn
Get Time	type = Ticks, time = 111343	2	Fn
Get Time	type = Ticks, time = 111453	2	Fn
Get Time	type = Ticks, time = 111578	2	Fn
Get Time	type = Ticks, time = 111687	2	Fn
Get Time	type = Ticks, time = 111796	2	Fn
Get Time	type = Ticks, time = 111906	4	Fn
Get Time	type = Ticks, time = 112015	2	Fn
Get Time	type = Ticks, time = 112140	2	Fn
Get Time	type = Ticks, time = 112281	2	Fn
Get Time	type = Ticks, time = 112406	2	Fn
Get Time	type = Ticks, time = 112515	2	Fn
Get Time	type = Ticks, time = 112625	2	Fn
Get Time	type = Ticks, time = 112937	4	Fn
Get Time	type = Ticks, time = 113046	2	Fn
Get Time	type = Ticks, time = 113296	2	Fn
Get Time	type = Ticks, time = 113406	2	Fn
Get Time	type = Ticks, time = 113562	2	Fn
Get Time	type = Ticks, time = 113671	2	Fn
Get Time	type = Ticks, time = 113781	2	Fn
Get Time	type = Ticks, time = 113890	2	Fn
Get Time	type = Ticks, time = 114031	4	Fn
Get Time	type = Ticks, time = 114140	2	Fn
Get Time	type = Ticks, time = 114250	2	Fn
Get Time	type = Ticks, time = 114359	2	Fn
Get Time	type = Ticks, time = 114468	2	Fn
Get Time	type = Ticks, time = 114796	2	Fn
Get Time	type = Ticks, time = 114906	2	Fn
Get Time	type = Ticks, time = 115046	4	Fn
Get Time	type = Ticks, time = 115171	2	Fn
Get Time	type = Ticks, time = 115328	2	Fn
Get Time	type = Ticks, time = 115703	2	Fn
Get Info	type = Operating System	2	Fn

Mutex (2)

Operation	Additional Information	Success	Count	Logfile
Open	mutex_name = Global\syncronize_FV4I9QA, desired_access = SYNCHRONIZE		1	Fn
Open	mutex_name = Global\syncronize_FV4I9QU, desired_access = SYNCHRONIZE		1	Fn

Process #13: cmd.exe

Information	Value
ID	#13
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:50, Reason: Child Process
Unmonitor	End Time: 00:02:58, Reason: Self Terminated
Monitor Duration	00:00:07

OS Process Information

Information	Value
PID	0xfc8
Parent PID	0xdec (c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FCC 0x C38

Host Behavior

File (25)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	5	Fn
Get Info	STD_ERROR_HANDLE	type = file_type	1	Fn
Open	STD_OUTPUT_HANDLE	-	10	Fn
Open	STD_INPUT_HANDLE	-	2	Fn
Open	STD_ERROR_HANDLE	-	2	Fn
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn
Write	STD_OUTPUT_HANDLE	size = 2	1	Fn
Write	STD_ERROR_HANDLE	size = 51	1	Fn

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Module (4)

Operation	Module	Additional Information	Count	Logfile
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff6e2e30000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ff850fa0000	1	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ff850fba990	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (11)

Operation	Additional Information	Count	Logfile
Get Environment String	-	4	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps;	1	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn

Process #15: cmd.exe

284

Information	Value
ID	#15
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:51, Reason: Child Process
Unmonitor	End Time: 00:03:11, Reason: Self Terminated
Monitor Duration	00:00:20

OS Process Information

Information	Value
PID	0xfe0
Parent PID	0xfbc (c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FE4 0x 5A4

Host Behavior

File (218)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	14	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	7	Fn
Open	STD_OUTPUT_HANDLE	-	36	Fn
Open	STD_INPUT_HANDLE	-	81	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	65	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	5	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 20	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 36	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 5	1	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (4)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0x47c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\vssadmin.exe	os_pid = 0xd24, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION	1	Fn
Get Info	C:\WINDOWS\system32\vssadmin.exe	type = PROCESS_BASIC_INFORMATION	1	Fn

Memory (2)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 206000631808, size = 1952		1	Fn Data
Read	C:\WINDOWS\system32\vssadmin.exe	address = 189245276160, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ff851550000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff6e2e30000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ff850fa0000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ff850fba990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ff850fbe830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ff850fbe300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ff84e410a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ff8515f56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (30)

Operation	Additional Information	Count	Logfile
Get Environment String	-	10	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	3	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	3	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn
Set Environment String	name = COPYCMD	2	Fn
Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Set Environment String	name = =ExitCodeAscii	2	Fn
Set Environment String	name = =ExitCode, value = 00000002	1	Fn

Process #17: mode.com

Information	Value
ID	#17
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:00, Reason: Child Process
Unmonitor	End Time: 00:03:04, Reason: Self Terminated
Monitor Duration	00:00:04
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x47c
Parent PID	0xfe0 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 49C 0x 374

Process #18: vssadmin.exe

Information	Value
ID	#18
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:10, Reason: Child Process
Unmonitor	End Time: 00:03:11, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xd24
Parent PID	0xfe0 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 598 0x 5A8 0x 5A0 0x 4B0 0x 388

Remarks (2/2)

Monitored Processes

Behavior Information - Grouped by Category

Before

After