b9ba3783...2a5b | VMRay Analyzer Report
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Wiper, Ransomware

VMRay Threat Indicators (16 rules, 1261 matches)

Severity Category Operation Count Classification
5/5
Local AV Malicious content was detected by heuristic scan 1 -
4/5
File System Deletes user files 1 Wiper
  • Deletes multiple user files. This is an indicator for ransomware or wiper malware.
4/5
File System Modifies content of user files 1 Ransomware
  • Modifies the content of multiple user files. This is an indicator for an encryption attempt.
4/5
OS Modifies Windows automatic backups 1 -
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection 1 -
2/5
Anti Analysis Tries to detect virtual machine 1 -
  • Possibly trying to detect VM via rdtsc.
1/5
Process Creates system object 2 -
  • Creates mutex with name "Global\syncronize_FV4I9QA".
  • Creates mutex with name "Global\syncronize_FV4I9QU".
1/5
File System Modifies operating system directory 1 -
1/5
Persistence Installs system startup script or application 5 -
  • Adds "C:\WINDOWS\System32\qjhqrs.exe" to Windows startup via registry.
  • Adds "c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\qjhqrs.exe" to Windows startup folder.
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\qjhqrs.exe" to Windows startup folder.
  • Adds "6115272" to Windows startup via registry.
  • Adds "C:\Users\FD1HVy\AppData\Roaming\qjhqrs.exe" to Windows startup via registry.
1/5
Process Creates process with hidden window 1 -
  • The process "C:\WINDOWS\system32\cmd.exe" starts with hidden window.
1/5
Masquerade Changes folder appearance 3 -
  • Folder "c:\$recycle.bin\s-1-5-21-1051304884-625712362-2192934891-1000" has a changed appearance.
  • Folder "c:\program files\common files\microsoft shared\stationery" has a changed appearance.
  • Folder "c:\program files" has a changed appearance.
1/5
File System Modifies application directory 1238 -
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\ink\fsdefinitions\main\base_heb.xml".
  • Modifies "c:\program files\common files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml".
  • Modifies "c:\program files\common files\microsoft shared\ink\fsdefinitions\main\base_kor.xml".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_copynodrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_copydrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_linknodrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_movenodrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_movedrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_linkdrop32x32.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifestloc.en-us.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvcatalog.dll".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvstream32.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01635_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01636_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01637_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01638_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs00439_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\cg1606.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\classic1.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\classic2.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\clip.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs00443_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\craninst.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\cup.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\cupinst.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01634_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00121_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00234_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00255_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00256_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00261_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\source engine\ose.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vc\msdia100.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vc\msdia90.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bs01639_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\crane.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\10.0\1033\vstoinstallerui.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00117_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\10.0\1033\vstoloaderui.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00372_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00405_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00407_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00413_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00414_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\vstoee.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\vstoee100.tlb.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\vstoee90.tlb.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\10.0\vstomessageprovider.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\microsoft shared\vsto\10.0\vstoloader.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00297_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00437_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00448_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00449_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00687_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00705_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01015_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01039_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01138_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01139_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01140_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01143_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00419_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01151_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01152_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01157_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01160_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01146_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01163_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01166_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01167_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01168_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01169_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01171_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01172_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01173_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01176_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01178_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01145_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\internet explorer\signup\install.ins.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01179_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\awt.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\bci.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\dcpr.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01180_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01181_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01182_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01183_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01186_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01366_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\deploy.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\dtplugin\deployjava1.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\decora_sse.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01434_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01585_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\dt_shmem.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01162_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\dt_socket.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01628_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01629_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01630_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01631_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01761_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01170_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\eula.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01586_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\fontmanager.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\dtplugin\npdeployjava1.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\fxplugins.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\ed00010_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\ed00019_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\ed00172_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\ed00184_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00006_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00202_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01793_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00242_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00319_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00320_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00397_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00902_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd01772_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00076_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00077_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00086_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00090_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00074_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00297_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00306_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00336_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00361_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00369_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00096_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00397_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00403_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00414_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00419_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\en00222_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00435_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00438_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\hprof.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00455_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00459_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00428_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00544_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00564_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\instrument.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00586_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00775_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00779_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00296_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00814_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00543_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\glass.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\gstreamer-lite.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\j2pcsc.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\glib-lite.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00965_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00382_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01074_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd00799_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01084_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01176_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01191_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01548_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01657_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01658_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01659_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\java-rmi.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jabswitch.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02068_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01196_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02071_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02075_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02088_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02097_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\java.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02115_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02116_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02141_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02153_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\java.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jaas_nt.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\j2pkcs11.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02161_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javacpl.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd01660_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\flap.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00057_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00084_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javaaccessbridge-64.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javacpl.cpl.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00231_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javafx_iio.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00235_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javaw.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javafx_font.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00241_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00260_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00276_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00334_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00443_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00524_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00526_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00527_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00546_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00601_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fd02158_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00612_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00623_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00625_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00636_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jawt.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javaws.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jawtaccessbridge-64.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\java_crw_demo.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00236_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00681_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00685_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00687_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00688_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00693_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00513_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00602_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh00669_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jfr.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jfxmedia.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jdwp.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\javafx_font_t2k.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jli.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jjs.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01013_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01015_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01065_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01080_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01242_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01291_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01329_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01618_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01759_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01875_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh01923_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh02166_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jp2native.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jp2iexp.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh02298_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh02312_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh02313_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hm00005_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hm00114_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hm00116_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hm00172_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hm00426_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jp2launcher.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jp2ssv.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jpeg.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jsdt.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\hh02282_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00177_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00204_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00233_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00343_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00346_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jsound.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00118_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00557_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jfxwebkit.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\jsoundds.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00915_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00919_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00956_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\klist.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0075478.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\kcms.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\keytool.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086384.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086420.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086424.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086426.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00046_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00351_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086428.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\ktab.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086432.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0086478.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\in00957_.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0089945.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\kinit.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\management.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\lcms.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0089992.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090027.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\msvcp120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\mlib_image.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\msvcr100.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\msvcr120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090089.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090149.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090390.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\net.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090777.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090779.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\nio.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\orbd.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\npt.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\plugin2\msvcr100.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\plugin2\npjp2.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\pack200.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\prism_common.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\prism_d3d.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\prism_sw.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\resource.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\rmiregistry.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\policytool.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\rmid.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\servertool.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\ssv.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\splashscreen.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\ssvagent.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\sunec.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\sunmscapi.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0093905.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0098497.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099145.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\server\classes.jsa.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099146.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099147.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090783.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099149.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099150.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099151.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\server\jvm.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099152.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090781.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099154.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099155.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099156.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0090087.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099157.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099158.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099160.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099161.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099162.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099159.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099164.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099165.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099166.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099167.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\tnameserv.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\t2k.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099148.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099169.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099170.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099171.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099172.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099173.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099153.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099175.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099176.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099177.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099178.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099163.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099180.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099181.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099182.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099183.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099184.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099168.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099174.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099179.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\unpack.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\unpack200.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\verify.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\w2k_lsa_auth.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\windowsaccessbridge-64.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099187.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\wsdetect.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099188.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\accessibility.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\amd64\jvm.cfg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\bin\zip.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099189.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\copyright.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\calendars.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\classlist.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099190.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\charsets.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099185.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099192.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099193.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099194.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099186.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099196.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099197.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099198.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099199.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099201.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099202.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099203.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099204.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099205.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099191.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101857.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101858.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101859.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101860.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099195.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101862.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101863.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101864.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0099200.gif.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101866.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101867.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101980.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0102002.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0102594.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101856.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101861.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\cmm\linear_rgb.pf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\cmm\srgb.pf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\cmm\gray.pf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\cmm\pycc.pf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_de.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\currency.data.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\content-types.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_it.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_fr.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_es.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_ja.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_ko.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0102984.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0103058.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_pt_br.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_zh_hk.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0103262.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_zh_cn.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_sv.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\messages_zh_tw.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\cmm\ciexyz.pf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0103402.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0103850.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\access-bridge-64.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105230.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\dnsns.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105232.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105234.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\jaccess.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\cldrdata.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\meta-index.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\jfxrt.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\localedata.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\nashorn.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0101865.bmp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105240.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105244.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105246.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105250.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0102762.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105272.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105276.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105280.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105282.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105286.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0103812.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105238.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105292.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105294.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105298.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105306.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105320.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105332.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105328.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105336.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105348.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105360.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105368.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\sunec.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\sunmscapi.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105376.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105378.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105380.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105384.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105386.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\sunpkcs11.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\zipfs.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\flavormap.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fontconfig.bfc.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105266.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105288.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidabrightdemiitalic.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105338.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\ext\sunjce_provider.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidabrightdemibold.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fontconfig.properties.src.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidabrightitalic.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidabrightregular.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidasansdemibold.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\common files\kw_necklace.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\arrived.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidasansregular.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\javafx.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jce.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\javaws.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jfr\default.jfc.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jfr\profile.jfc.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105388.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105390.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105396.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105410.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105414.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105490.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105398.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105502.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jfxswt.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105504.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidatypewriterbold.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jfr.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\logging.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\jsse.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105506.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\fonts\lucidatypewriterregular.ttf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\management\jmxremote.access.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\management-agent.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\management\jmxremote.password.template.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\management\management.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\meta-index.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105520.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\net.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105526.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\psfont.properties.ja.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\psfontj2d.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105530.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\plugin.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105588.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\resources.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105600.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105638.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105710.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105496.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105412.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105912.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105846.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\management\snmp.acl.template.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\rt.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106146.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\blacklist.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0105974.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106020.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\blacklisted.certs.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106124.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106222.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106208.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106572.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107026.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106958.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0106816.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\cacerts.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107024.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\java.policy.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\java.security.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\javaws.policy.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107042.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107090.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107130.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\us_export_policy.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\security\local_policy.jar.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107132.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\sound.properties.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\license.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\release.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\java\jre1.8.0_144\lib\tzmappings.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107138.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107134.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\office16\ospprearm.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107150.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107148.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107152.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107146.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107158.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107154.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107182.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107188.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107258.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107192.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107262.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107264.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107254.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107266.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107280.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107282.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107288.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107290.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107300.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107314.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107302.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107308.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\governments.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107316.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-math-l1-1-0.dll".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107342.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107358.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107350.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107364.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107344.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107450.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107426.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107452.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107456.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107458.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107468.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107480.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107482.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\appvdllsurrogate32.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\appvdllsurrogate64.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107484.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107488.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107492.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107494.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107496.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107490.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107500.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107502.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107512.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107516.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\appvlp.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\concrt140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107446.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107528.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107544.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\mfc140u.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107514.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107708.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107718.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107712.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107722.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107526.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107730.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107734.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107658.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107742.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107744.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107746.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107750.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0136865.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0144773.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145168.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145212.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107724.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145361.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145373.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107728.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145669.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145707.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145810.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0107748.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145895.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145904.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0146142.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145272.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0148309.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0148798.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0149018.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0145879.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0150150.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0150861.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151041.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151047.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151055.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0148757.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151063.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151067.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0149118.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151581.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152414.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151045.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151061.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152432.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152436.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\msvcp120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0151073.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152556.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152558.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152560.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152568.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152570.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152590.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152594.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152600.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152606.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152608.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152602.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152626.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152430.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152622.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152628.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152610.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152690.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152688.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152694.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152696.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152708.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152704.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152698.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152702.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152722.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152882.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152716.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152884.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152890.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152876.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152878.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152892.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152894.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\msvcp140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\msvcr120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\ucrtbase.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\vccorlib140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153087.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\carbn_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\cmnty_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\client\vcruntime140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\baby_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0152898.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153091.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153089.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153047.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\east_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fall_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\explr_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153265.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153095.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fincl_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153273.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153093.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\grid_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153302.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153299.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153307.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\grden_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153305.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153313.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\htech_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\indst_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153398.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\fincl_02.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\java_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153516.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153508.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\music_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\jngle_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153518.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0153514.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\ocean_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\nbook_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0157167.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0156537.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0157191.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0157831.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0158071.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0157177.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\outdr_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0164153.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0158477.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\paper_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_02.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_03.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0160590.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_04.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0171847.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0171685.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_06.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_05.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0172035.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0168644.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_07.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0172067.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_08.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_09.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0174315.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\road_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\safri_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0174639.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\schol_02.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\parnt_10.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\show_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0175361.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\space_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0175428.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\sumer_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\sprng_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\swest_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\urban_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\wnter_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\frosted glass.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\extreme shadow.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\vctrn_01.mid.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0172193.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0177806.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\glossy.eftx".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178348.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\glossy.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0174952.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\grunge texture.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\glow edge.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0174635.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178460.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\milk glass.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\inset.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\office 2007 - 2010.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\riblet.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0177257.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178459.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\smokey glass.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\reflection.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\subtle solids.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\document themes 16\theme effects\top shadow.eftx.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178932.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178523.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178639.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0178632.jpg.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0182898.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0182902.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0182888.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0183172.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0183174.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0182946.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0183574.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0183198.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185774.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185670.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-utility-l1-1-0.dll".
  • Modifies "c:\program files\microsoft office\root\flattener\appvfilesystemmetadata.dll".
  • Modifies "c:\program files\microsoft office\root\flattener\appvfilesystemmetadata.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185776.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvmanifest.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185780.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185786.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185778.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvopcservices.dll.manifest.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185790.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185796.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185798.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvpackaging.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185800.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185806.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvpackaging.dll.manifest.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvstreammap.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185818.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185828.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\appvopcservices.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\concrt140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0186360.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.appv.eventing.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.appv.modernizer.csharp.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.appv.modernizer.common.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\flattener.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185842.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0186346.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0185834.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187815.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187647.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0186364.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.tools.binarystore.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0186362.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.tools.office.c2r.common.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187817.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\msvcp140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\microsoft.tools.office.c2r.packager.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187829.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187825.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187819.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187835.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\msvcr120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\msvcp120.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\ucrtbase.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\vccorlib140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187837.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187849.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187847.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\flattener\vcruntime140.dll.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187839.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187851.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187863.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187859.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\c2rintloc.en-us.16.msi.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187861.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187883.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187881.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\integrator.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187893.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\c2rint.16.msi.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\onedrivesetup.exe.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187895.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0187921.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188511.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188513.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188587.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188667.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\qfe31928.msp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\qfe31927.msp.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188519.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188669.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0188679.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\sppredist.msi.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195248.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195254.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195342.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195320.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195260.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195428.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195772.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196110.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196142.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196354.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0195788.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196060.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\integration\windows6.1-kb2999226-x64.msu.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196358.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0197983.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0197979.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\j0196364.wmf.id-b4197730.[decryptyourdata@qq.com].bat".
1/5
Process Reads from memory of another process 2 -
  • "c:\windows\system32\cmd.exe" reads from "C:\WINDOWS\system32\mode.com".
  • "c:\windows\system32\cmd.exe" reads from "C:\WINDOWS\system32\vssadmin.exe".
1/5
File System Creates an unusually large number of files 1 -
1/5
Process Process crashed 1 -
  • Unmonitored Process "c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe" crashed.
0/5
Process Enumerates running processes 1 -

Screenshots

Monitored Processes

Sample Information

ID #639141
MD5 de280727b467a3c874321e0d9faf9084 Copy to Clipboard
SHA1 89b9e6ff2ead2449b8da813afa8c34f52f421fd6 Copy to Clipboard
SHA256 b9ba37832d0446610aae07218b31ea25ae68d72da68d8bb70a9e163efed72a5b Copy to Clipboard
SSDeep 1536:mBwl+KXpsqN5vlwWYyhY9S4A8e8wlYsao7xyKMlmuwqxH76KVwu16:Qw+asqN5aW/hL2exlYBo7xyK0mGxb6YG Copy to Clipboard
ImpHash f86dec4a80961955a89e7ed62046cc0e Copy to Clipboard
Filename qjhqrs.exe
File Size 92.50 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-05-05 23:59 (UTC+2)
Analysis Duration 00:03:21
Number of Monitored Processes 13
Execution Successful True
Reputation Enabled True
WHOIS Enabled True
Local AV Enabled True
YARA Enabled True
Number of AV Matches 1
Number of YARA Matches 0
Termination Reason Maximum binlog size reached
Tags
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image