9c63223d...96b9 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Trojan

cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe

Windows Exe (x86-32)

Created 6 years ago

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (1108)
»
Filename Hash Operations Source
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini - Access, Read
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry MD5: da5f19a08dd26102d76fbb78b074d4b7
SHA1: 418386b0e865c4bd995bb3d51499136fa2c8374d
SHA256: 4cc396c233a48dd41f02f16952d724ee93fefbb6b74fd5b70c40548d222a7738
SSDeep: 6:UlFRz80kxtd5LVbs8mSU6WCt9qiNIhHcwNlnpE4S48s4Rim5D6C/QXet:Enkxv5Ly8/HNIhHcUtlS4cju6
ImpHash: None 		Access, Write Dropped File
C:\Boot\BCD - Access
C:\Boot\BCD.LOG - Access
C:\Boot\BCD.LOG1 - Access
C:\Boot\BCD.LOG2 - Access
C:\Boot\BOOTSTAT.DAT - Access, Read
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decryptoperator@qq.com].cry MD5: f89fd741eaf7ddeaadb5bf8d08cdce7d
SHA1: 734d6db24572f16d5e241a3860a347cebe9826a5
SHA256: 14a36df853b30eae5eae92508d1a4d63314b3248113278458cdca132f1331167
SSDeep: 768:mmGt+0EEm9pPjWs/vhx2yP7CuUJFlKlO0Y1GQdhTpB9LxvntgbDUA3aNqQ8+DHI1:EdA6+hfTCFRKlusclTntgsoQ8CHI8TsR
ImpHash: None 		Access, Write Dropped File
C:\Boot\cs-CZ\bootmgr.exe.mui - Access
C:\Boot\cs-CZ\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\da-DK\bootmgr.exe.mui - Access
C:\Boot\da-DK\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\de-DE\bootmgr.exe.mui - Access
C:\Boot\de-DE\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\el-GR\bootmgr.exe.mui - Access
C:\Boot\el-GR\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\Fonts\chs_boot.ttf - Access
C:\Boot\Fonts\chs_boot.ttf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\Fonts\cht_boot.ttf - Access
C:\Boot\Fonts\cht_boot.ttf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\Fonts\jpn_boot.ttf - Access
C:\Boot\Fonts\jpn_boot.ttf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\Fonts\kor_boot.ttf - Access
C:\Boot\Fonts\kor_boot.ttf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\Fonts\wgl4_boot.ttf - Access
C:\Boot\Fonts\wgl4_boot.ttf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\fr-FR\bootmgr.exe.mui - Access
C:\Boot\fr-FR\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\hu-HU\bootmgr.exe.mui - Access
C:\Boot\hu-HU\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\it-IT\bootmgr.exe.mui - Access
C:\Boot\it-IT\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\ja-JP\bootmgr.exe.mui - Access
C:\Boot\ja-JP\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\ko-KR\bootmgr.exe.mui - Access
C:\Boot\ko-KR\bootmgr.exe.mui.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Boot\memtest.exe - Access
C:\Boot\memtest.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\BOOTSECT.BAK - Access, Read
C:\BOOTSECT.BAK.id-9C354B42.[decryptoperator@qq.com].cry MD5: 49931ea503aef3c813d1c9336e4fb02f
SHA1: f73c54ae30a6fcbcb2b53029f98ef08fd7ccacda
SHA256: 7307dadaed2826eea9dfee747cf20619726013304acf00530dd79f8cf3c43f06
SSDeep: 192:UYgqGiv0xeI8B0ZssP3nSSedsDkPjuo5KbYIGcR:F70xePWZ/3redsDkMR
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab - Access
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi - Access
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: f0c0c342f83e0b0509a09530ba1daa2e
SHA1: 37ae2397401425579ddc7e2f39316ef9873dc1cb
SHA256: 3ee33fc2c4e29b00cfc2078ab92992882f9adb137e9dcafeb62ae7f194bcc4a8
SSDeep: 49152:zDxL8QBo0Tex4S120ytJybwjKehJ62ilFotoHqSATH:zR89t1/eNUFotCAL
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: f754bc22c636917c9a705da9ffda3d9e
SHA1: 8bda1e17bf887ae90a709c3de3df99fb4a4aa162
SHA256: 33d6591999c32bc4e36b7c7318086fe4861c70e847f88a97819c1bc71af654ae
SSDeep: 48:HZv24WSLvM6ol6L9HZXY7y4ZhWNmB5dke1cR:HZvxhjulGTX+7bWNmLLcR
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 2648af17a20e0e8dfcd0c92ec0983a52
SHA1: eedb39c66b019fc68c5eea55c6a797f9dec252e4
SHA256: 5b54a351c6bcd7c5a07b1819f1faf23621a52001b78587a6e3032d76a808171f
SSDeep: 48:ZPAkfOihEerGoOWsfewKoktSSbqcqw7FLcqmGwPcnHQYIKc/:ZQeSoOWoewKf0qqctcynwJKc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi - Access
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: b498b20f19b902dc41463842cfcc1d08
SHA1: 7dd7d383d5d708ff10534827bbc162f249bb38b9
SHA256: ea8263bba780d0ed2c5e5b7b3dd4cfce9c779b7a9a75c9b0232f0f6604e571c8
SSDeep: 49152:zDxL8QBo6Tex4S120ytJy0T1l1uIV8QSf9:zR89j1otDSl
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: fbb9127ea9bf97d78f589505a0a6281f
SHA1: 87345ae195e87b155a8da3b07f7ea373b7329a79
SHA256: e0698f5975bacd9c3f20f5d660707789dc62e4457363e42926c7f2152412ed6e
SSDeep: 48:xAp8vUKdWhF0UXsHmQKdzgEcnEJe9pes5fn0teWcv:s8vUKdWhF00JrdzuX58cv
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab - Access, Write
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 55a36659db0e51f1faea534f72d0ed68
SHA1: f05a92ba98071dc8474f72608b862aa423978557
SHA256: 8843b34160d622765a62c6c173b74673f2c9a88c087548e50b3eea149bae053e
SSDeep: 48:L0fOx46u864wweuVXKR4aTbk+5AfylaEXEVFirSvcSc/:wGJRwwjOTVaHFVcSc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi - Access
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: 09e81942f4a0ce36d9eca8c06a3c01e1
SHA1: e5b4bb6798a6b3b23479516ed3b7ad9e9731af4a
SHA256: 1470c545ebe2d249a77c961e602916cf259822018e21783d60f807640928ff7f
SSDeep: 49152:zDxL8QBonTex4S120ytJyQltgxV0pp6uavJzAjWpr:zR89K1A6xGpMDvJz6Wpr
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: da53a2fa054331cac2eed871a8cb1348
SHA1: 3583dbfde95742a09049ca5472de8f0c2f4a5283
SHA256: 374129657504bdb29533e0d168ef29040a1b06333941de80aebddf167de0a931
SSDeep: 24:nHffyJVAIWfh5ZWoOs5XTXSHVsJPQvFDGI/vH3dOy61sNYxpfrSVF6jVXKH4KQnT:nHnZXl3lTCSMFNOPDfuqXKH4KnOeXcZ
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab - Access
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 84b60cdb20431c41f05666896bec6899
SHA1: d3ba9e55dc0d1fe5bc78138b66e255294be1a09a
SHA256: b70c7e4e96dfa72f6c72ba65aecf6d4696e2c3425c885ad369c1ee329482e883
SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+k0Pl:MUvTiNhU4L7tZiTnprP0txRsn
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 35bcc9404a17d31dc9456b6b1d0e5992
SHA1: 78b7da896d695df0c0b24400c34dc802500ddab4
SHA256: 7a41026b2e94f704cdd337d57586214afc995219917d2e7a4c61b2fefd5252a0
SSDeep: 48:DWWngfkypgb+HBVWz88e59i8iGk9lir1rLu+524LO0c/:DLmhabEp8f+524LO0c/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab - Access
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35
SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi - Access
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: ebc60c4db49a7b84dad9d7da2edfd213
SHA1: c5e35fed004d5236060f7021237a8bee0638b1f7
SHA256: 34f4900e7ae4e78cef36a660c74f39819ea4ee151c07964fd20f96260998799e
SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6LWu/zi65f/rGpfxQ7cYM:fqLVW6v3XziYf/apZQXM
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: b61bef7b1ff22f68be00fac000738d9d
SHA1: 37ddcdc37a1535bfc1542b82be0482a84b23b85b
SHA256: 64cde24c03ba4afccc819f0532f83d5d5e6e6f79768cad22ab2c63e39e46bdfd
SSDeep: 96:ILRq5Zyi/y2s49eVycA5fh+WPrzOvxFZKYc9:ILRqyi//soeUcA5fcWHUxFJc9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1841d0d5817c4ed12b0e8662f9f59907
SHA1: f488cee894b5f723843d4554fdfb1ad2f2274250
SHA256: 192298b8c186a1f3b544df0e0359a4deb9d039587b545b4c469f8482b449ddee
SSDeep: 96:sM9vQulcQwrC0hsZIUkagfG5DmN+RvrjFewVV4RO1+fc/:sM9vQulPuIHxgGXXzcUGc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: da2cd4c0fec8e59b1b23bf915de53de8
SHA1: 4da4ae979e8cf30008556c9c0a3c4a08f554049d
SHA256: eca2fbc45349ac8a8cc5298c2970d888043f2d415a75ee6618aaefbe0f8622bc
SSDeep: 48:+EOBvMB7eFbQVsJF0CzABmfDVupRlL32Lb3YhezKlcDHbEdNzzcQ/EDT0rQR5i3m:+5BrbQVsJK0ABmfxeliLbC0KlcTb6pwb
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab - Access
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi - Access
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0878d1e108f93a14e8831dff943af1d8
SHA1: 504a47951bbf3300d3363b529372ca38715625f6
SHA256: 1a8ab2c5e66fd3d4a17a5cddbc124eda83d9133c1ac10acf69a6c56b924f2a28
SSDeep: 24576:zxnP6WBzkm83xgDBo8o93HeJP9VB5bxQrzVDFJdjHs5wuofLfdky20ytJytLmB0X:zDxL8QBoSTex4S120ytJyt+yo3TjoLIQ
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 72c69099d419f05734021059a4e3f72f
SHA1: 7002c63ffd4e51ce880219abca5e1869a20b4917
SHA256: 42700bf08c9feba88a0b5c6b11603c2bbfed9771959c884162fd5591bf150130
SSDeep: 24:f3E59RtFhulc+ll7oNrXVzdDTrqs0W5B9BHwZW8VuVNtGXvOXtCkIeVHoLezxSem:PZcR3DTKENHwYVN+upXt+vejc7
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab - Access
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d
SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021
SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi - Access, Read, Write
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: ab24ffaf83f089260f861119e7447467
SHA1: 4664ad18cb6876e7e14538f001fd9efbfda78414
SHA256: 5ffa23802eb2625d68b2f46a88985112fe0d62cefac31d72c1599a6e3e8c4b8f
SSDeep: 24576:P0lJ7q2//mGCRzrhpkVAGUGpYGUoWojltTNE:P0lJ53ORiRU3GU8te
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 53d0b079d6fce1269dc5fe9e75fc9c6f
SHA1: 7de7bc6ac065c5e320404310a184ca89a00d574e
SHA256: bcc135bea8de1e66e2f2b6d01346c22966f2a047568688515f730c960d3544df
SSDeep: 24:+gV+SQCROSO38gLVYFtl8/ezDUcWL6rs2UyXJDQvbo9TdEcZ8AwVEMmDI8qr6E+7:+ggSJwMgL+3Uf6reytIu9Zk9x4iNm6c/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab - Access
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163
SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455
SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: be2b5646cf2536c1484c407e2f27227c
SHA1: 9bde3e16751bf85e2352cd65456389399bcd4051
SHA256: ae15f70e2ef202b6c3a02d945598167781dddc762ac3ec67e54eca46ef1a09ec
SSDeep: 24576:YWJIdE4BNi0KPWJ4kDHpgJe3Hrn+K2+q2zGwGiRNo:JJSJHi0O44ktCQn+uqYGwbm
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1e2cbd179dc504ad580a1919664b2e75
SHA1: bd827807d223b14f27da2e8b25bc12665ed645c4
SHA256: 2f6ac3952e34dced8c6eb0146e2b2a5d5e7c4959682dfd443476f4d6d3fb0563
SSDeep: 48:vb4rd/kMjEvotfJtmWKLgzCTVeTd4F16c/:EB1AsTQgz+ks6c/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab - Access
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0
SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f
SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: d8859124dc9909b335a2e52061cd8705
SHA1: a6a273793f20e642dd041c6650730f828a7dd0ae
SHA256: 93e936e1675f450c11f90d9cd6580cf65628130dc26fcb66e0574df527344915
SSDeep: 24576:O32NohAYA3KDn4NqxoQiP9y1EtI67UJBBGOmou+ATqjCjTOLybzUc:2YsjjxM+iMBBGOmoNATvOu3Uc
ImpHash: None 		Access Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 12d3d4ab325f8d311946ff9e204c17eb
SHA1: 547c530641c09bd231a4465a059778902331dcf4
SHA256: 71405985ab007c9f38adb3477026f7f3764a9700bc0b58461d1f167879e8f51f
SSDeep: 48:61CYN+sXIxRe66LvSwRovKc0+sBoWR2CBc/:/YNwRJ6Laa3JBoWR2CBc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: 117ce9be2084cdf4de7a90c665b610f0
SHA1: 1747c7c2857dc2631a834a65e5997b20d2343841
SHA256: ac4e8c73c65ce188ac09715a735f04f565d2ca3819df911fa6cc59c574084ab7
SSDeep: 24576:jIfJQdG5nUrc0zrwZ/PPdkRcImmG0gP3Djbqx:0BQp6/PFygP3v+x
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 4b4c8c01b9938942321b4a282487d99e
SHA1: 0832b3f5cf7b47098689f0a9790a8ef41483a0cb
SHA256: 021b02943f88be361540a308a9ce89c12d4ce8d3e44a956506564719bc014a9d
SSDeep: 24:Pqo6XaLsTQ6aZsjZPnGLxclqX/hUNvztkhLzcYvpiVtVcTt:PsBaSXlqXqLtuLFpi1cR
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 029efbdddec0121d97139fb7fed1ce53
SHA1: 9d1d4a151954715ba247072d75af3c81bfb32b5f
SHA256: c01b62e99a83bc82fabeaf95801fa53a56ea47ff09b8fd5a02424604d8475fba
SSDeep: 96:/bjHGgY4jle7Ojw6KkAi1fxO2zb1BWRtir3BecJhmTSHBAdGRLVikHr4C5c/:3HbY4jle72PKhi5fdii7BecJhmGhAdGU
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi - Access, Read
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decryptoperator@qq.com].cry MD5: 4d4c0625a337e0ddedfc767dc86468d1
SHA1: 727c6ecddd39ef4477fd5fbc9b17bb5613b3e8d7
SHA256: 492175950be0aeb7da9ad59213c49f0cd929d45edec143d915fb8758e82ae08f
SSDeep: 24576:NXEqnhYJSsYMnHPEETl51zZB8nGDWlHYrBNo2hQ:6q+JSsHHdzcnde9NJC
ImpHash: None 		Access Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 89d89476ac2c03bfcc143c05b1f1f614
SHA1: 598dc6d01d49a4f920f66b55ef42a27a14618ded
SHA256: 8969e061903b17bcc3ad0f280f5505232207a8f970799a7fb6b9b79462a2b022
SSDeep: 48:ogKV1OyAu5gVDjtLvBuRN+9fFZ0k1eHYcD:hKVgTBVDjxpcOfr0IcD
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab - Access
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: 2da937cddbde9bcda2bd6d5018ef33a5
SHA1: 8414c016f7e0f8a69c5bc3ff0c260b7f09d62906
SHA256: 6bedaaaff93668292eeda5ca80fd13d25a023cb5383b81dbb1d47f11af6928ad
SSDeep: 49152:AeFNMMFrwnbddIOxFOSOwPFhbYRjfIDPHLoBTv5oJBB47q5FqciqlqjX6nM:zDMUwxyODPFhbY12HLodiF4+5riKeoM
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 509a6d5e0dcb6cad9a2e31dc8d60fdf2
SHA1: 6d9d901f0e39c87202d10bfb57c34e7bde0a2b2b
SHA256: 0d9768157381f427993c5f7fdf645e1c7654e5a067a819c3ef1a98d79aca3e42
SSDeep: 48:4kHArXGBWL40vYyHLWhd7J5yGlHMyjKvuhwDYndx+dttWc/:PAjGB2XvYGWL1BlHZKInd0dtsc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab - Access
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decryptoperator@qq.com].cry MD5: d0270fa686df7e1fbae95ad8489a5b5a
SHA1: 3d43a29d7087167d3f8e12ec237a8b25599cca07
SHA256: 677ba720e203d1ce322f4a4d6e6e9933c277afc51f1d336e6c7fdd7380a2c263
SSDeep: 98304:llyaDH9kcidg6C9NfjN0+inHftQADI0Ns:iaDH9F7/iHXDI2s
ImpHash: None 		Access, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi - Access
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 9207458f4cad805057cc8ca83b332cf0
SHA1: d5e2954af0b220600450377d7a893894e9ef321f
SHA256: 1860491676ae364f8cdd5a50a5e6e6eabd6b3cdce435a456e586c3876f4a475b
SSDeep: 24:OD5Ui0x9meoLUWX1n83zjVDNzDPwaOioApRbNwYdcd3Ez4Kmh+p2+zbOeLtVcD:OVUib9n8XVDNHPw/io+234DmQH2eDcD
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 78fadb9da18da398b4d372b9d1eb75d9
SHA1: dbf455987d8a0c7c4892cdfab58bd875cff2e0ba
SHA256: 781c473233671b1e183f77ee236a19c7379b08184f069060ebfd495c75142d30
SSDeep: 48:R4MZmItAvddVHc6ROLlV6MwV5n+bWTNc/:R7Zw35zRIwx+bW5c/
ImpHash: None 		Access Dropped File
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 94eed9d607c6a08d37d1d23d7e10deb2
SHA1: 70ec870f77f457f48f2a216679500d07f6a41a83
SHA256: 1852048001cf6b3f829e441dd80818b43c75cbd4b337704d6b02f101c1be4ddc
SSDeep: 192:TE72zGKAOM/EiwQhy2F2tgiGSnhKBuJi6rv9c/:TE7k4ZqQQ28tnNnhyugkW/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab - Access
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi - Access
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml - Access, Read, Write
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: bbea6a6ec29a13e9de5ba1a2afe456dd
SHA1: 5ac4fa7d32ea229357a59b958dc20bc88318b2f2
SHA256: 2456f3058f98d7ab5049c624632db14ebae59e491b5fafd7a8f1af3f61809095
SSDeep: 192:y4hg16augT7e/qJsvYWZ+v4NHjmyVZ7vJhhUfL4e6uAXIPyCctiVcR:yrLT7eqRw+wNDV3hhkL4CaCYR
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi - Access
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 7da6eceae572a724860687905c281e92
SHA1: 09fb9423a13406a9313fea45faadbb3badf6d5b8
SHA256: 6724f4fbfbe2e8aa816c7d1577bc73829f13dc0efcef8c751ade823ff2155e30
SSDeep: 48:SvyXDHewjV5hV5a5Pa4YKSYm+Fbltam1aleLc9:SvqXlSPXSYmxm48c9
ImpHash: None 		Access Dropped File
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab - Access
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Write
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 796b6f2ea699af44d325b663765d9841
SHA1: 72f99535c833aaac31dd4e81ad7435e3ff141f39
SHA256: 6e6b9e8794b3336504d88133a8656b68fd002943b7fbe80de654bee9c85c6c38
SSDeep: 48:5SiB4Yz4Zm0UQmsg5Ao4yfg6r+X5DWVEBcjrlZDadFhqY73li5c/:1OFPABGDWEBsrioY73li5c/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi - Access, Write
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3c03ca759139818de3a4408c6ec39906
SHA1: 91b1c3dc3545b423e9b204f649ce31cc459192e6
SHA256: a3ce4e2daef7eb129d63e1d676ccac3bbd6467d0f4a4ea65ce9324fbab42501f
SSDeep: 24:/ayI5RqsLHiQc4YL7W8ep81qh3Dtf6iVZZ2/0kSoeadrDi1As225emeAtVc9:9Q0um7W8e3DgeZA0kSoealius2set4c9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab - Access
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 40d0108ad15fe1981ae71f699ef24ecf
SHA1: fdf50d77129cde7db49505694e8ef21214d059bd
SHA256: d9ae2d5c093b95db949af6d81223c908e91a520fb42ee533f95e50e146f40487
SSDeep: 48:UOUZK8hSa6y6PHZkBqVMBGHT2srrmGh5a9Nc/:IHoy6/ZkaMBGHxWQY9Nc/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab - Access
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi - Access
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: cb0d32878116323a9887777fdbd55c91
SHA1: b2b09f6f440665e8e4fa7e3868e07edce391fd57
SHA256: a8a89f62d27e8bf8304b0e52603d4bf23c78bad825f68f92d8f3a7c67cb30720
SSDeep: 24:CBIqUlh2Jtpu4c2pTLTun2eUy+v2PsoWVYpeOotVcn:JqUgpuSP6n2eT+uPYce/cn
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 44c83eb63be8b50f69e009cdce125883
SHA1: 636e90146155120e85f07f3d9f8522be3a5807a8
SHA256: 63f9b63fdebaa31382b5ae0be176457754eba8c42f474a898a9538c425f1e4c1
SSDeep: 24:JGTg555mLZ3HvMzLfYpYOPOdCUhaU7FmtZnPd/Lx9849ThxYtET41LiRtVc/:4TgpAXozn7edjLV9ThxYw4sBc/
ImpHash: None 		Access Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 81d0e9fb5933e9563ad9b8db1a8340ee
SHA1: 375474ceb68d17391702ba2f03aee75b4c61b851
SHA256: b802091fc517640b8bee5ff82d0b9df6beba9113002cbeded700958dae3a5b1d
SSDeep: 12288:Sa5JVH44EB5CUiQLvx+a/m3alfddSgbwmCtywQD1OCKxP:NXYD5CUfL9/m3kfKaqtnLxP
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE - Access, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab - Access
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi - Access
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 194e74a87c6a2de38106e05501111f26
SHA1: 4048dda3722ed35f7be338eb6e70bae2c15a724e
SHA256: 57dc07c8da3aac8427579541bc74e9a3caafbe4c41fbd8858853ba046a0c19cc
SSDeep: 96:XzV7eG0I/FAHsia0nMwfQNvoNhleLMlJVes2iFMudtuwmxorVcn:BKoiaIpfQNvgiMlve3iC+udxorVcn
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: df1b8e6bf61a226877f3970fd927e763
SHA1: bcabf9fc96ac2e9e1924912831355846946d5dbb
SHA256: 07145689a1f9302d9178d1dcfe265d7f7c09339a80fc95c31578420d519bdb06
SSDeep: 24:rijv/pYAznbev95u+9bFwBf8vyFO7MUqt1cRWW8S2htVcZ:rOtzny95u+9eBfYyFH5iKS2RcZ
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decryptoperator@qq.com].cry MD5: 5912665f096156ff658a137a5020cc71
SHA1: 98824bc021d8e1f2b3d5cb1d46c98fbee279b14a
SHA256: f39739b80e5c29b53cbea2c8a91d8e082faca6d5033c13fae636897f922fa647
SSDeep: 768:T2L3oVkt/WvidCB3H18/5Qmnhoz9sA5TTfhffvsFfV:TwoVkNWpZH1xqo75PVsFV
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decryptoperator@qq.com].cry MD5: 03bfd0362ba038860caaf99095d9b23f
SHA1: 061d40feca5dcfed3a2a4adb9e66fe282add69fe
SHA256: bbc4748a51d7b8710a1d2e094eaff783a5e18ab8b7fd853f66251b7833049b64
SSDeep: 1536:CV0+SmObkBBDxHSU2RUR1E62tKXhvNPopVsmIQ/:w0AOYBFxf201P28hvNTmB/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 87e66004b0f5a8a6701823cba8b75155
SHA1: b3a1e53f99df175203eb7be62a93294ef4875bf0
SHA256: acb7a3e55fe8c3bb14dc1c7ceacabf43691f0a1a0e0d1dbef91062ae626103bb
SSDeep: 192:UcgSyUJihlq+G30mtng7wB5LU2cRu1wjQJU9xjNz+BKfI5jc/:UcgUMhlqxLOJRuWjxJI5Y/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST - Access, Read
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi - Access, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 83537c74a03b364b6d52e19ee06ef1be
SHA1: 7cbf41dde8ddf477265f9d6e7928cefc032968bb
SHA256: c655ec5d0a4e5f1469dafe3a4f95a14b962501bacfe32ad3081242fc821d1ecd
SSDeep: 48:SCPokPCb+GPhb4SmtG0lz04211z8/eOcn:jwgCb+Ab4SIA1xmcn
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: f8d876e8c600820cbe679b0eb3acd4cb
SHA1: d5df6c2702f344c233af38eed2454329748451ce
SHA256: 6a82efa51e5037b79a5b5b89a56beb02e331ec87418029afa9f77f51f1cc1a03
SSDeep: 12288:D5rDMHQ0v5eDFM2jit+hRDh1BNeeeplr7fWoevXvP7:s58MQrhFDBNil3fWXr
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 52f080662aa5b42476367a92d761584c
SHA1: 54f16c974b66e6ebf3bcf626ea2efd44f0b0671d
SHA256: c7a77aa98791c36ca3f77eb71c122a33be99b92c65e9d8cb5f0ed1fc1e19a274
SSDeep: 24:guehdrMK2YYsonNnjut6ZjObCeL4MIJQDpwEtGOjlw8PM/SWS2O6tVcZ:hUuK2YYsonlfi4Mb1walnMc2OicZ
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 4de0df57143fa1e4881c65611ddeb5e2
SHA1: b94d9cafcd03a6bd6d1dc63fafd361b8bc5a93be
SHA256: e8667bd6beabed4fc213b3480910f0d9bd4aefb59517cbd61028a5eeaa69cc77
SSDeep: 48:UwuiVFwV9lieH/O9067hAJZ+SEptK8MkfbqO1pUPfwjPNglJNzxt2w1CKD6zn7pF:7u39PHb67hObE/TMkfbJpUH/Rxt2wVML
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 55b4620da8c292ce555b5a07d0144f26
SHA1: c3a15ccb005bdbdc50d0410d1e16e7181df68544
SHA256: 6bb67cd2684d79260d7a9de3eb420dcc7b877f011f4eaf37b87154ed177660b6
SSDeep: 96:AyiqbF7DgBnPQ271NXEwROpjwIVYV3tNfaPV4QWXjjveX1oitc9:AyLFgBn98waq3Ct8vuGkc9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: aa79e4bdb0c22a813e1385dfe9f06e27
SHA1: 860bc608a459b84684319baa72b721c2e20d302c
SHA256: 61e32f74e114cac594174643c7f92021ad975c14774c7ef50d51af301c8a4351
SSDeep: 384:zF1JJtd5COXOV8zX3qWWrBJhD0zqXc2lZln3ygURMdkv8+ZmlFLPGNCJiJJ9:zF1sO+CqWWrBJGzn2lLHSxEFakwH9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab - Access
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3920958d2d6e6d143bcee51472f273f3
SHA1: ad5adf2fcd61e45f4b1b7cb68587b373fdebb90f
SHA256: 46db404e1076811f601c92685cbdca4f0046ea8851588f36e729d944cdc96b23
SSDeep: 768:To2l7cbZW33SUpNRLxNy6qyl9tDpyeAF3+2xdbHKk1qK2/:To2l74Q3VpnLx1qyl7DFK3Duk1qJ/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: bf90d6ab6c232ec26e1e6a296c53551b
SHA1: 20438b0a525f7475c8721abd742a971b14d3891f
SHA256: 827cd527e5ff8778fb02fce5ac276e6939d1e5204ee24975043c2cd49b48d9a7
SSDeep: 96:XfMkTB2F+wgM6KdMfDW77I+kL6Lktsc0VTl+Rfc9:XfngwwDRneOmJGlgfc9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll - Access
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi - Access
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: ef88b32a2de581062855febead3807a2
SHA1: 8dbbed6c240a305b48bffbb631a726af70add2cd
SHA256: ae6818ed30f84601e6b3604c0bd3bc7c81d81edf337765c72f4785308f4e10d1
SSDeep: 192:6E3fssFjOz3ldsRS37wrjLY+OjOY26CdCekcEz5Ccn:6obFS13s/LYtyYQCHcQzn
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab - Access
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 5ee82e7e1efa321a38e7207013f98c41
SHA1: 69b7293c74c455d7d0e9b9f5adf5f834d8eece08
SHA256: 0c1932484f4174ed5b71ae3d9e9be3028db5aab973d7710aa31e349cdbe4734a
SSDeep: 384:CsyWk3M8mnsPEJOwMBjqmj5rADy2ndzRAEUPXnvzRR/:CsyWaPEJObZC22ndR0zP/
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0542b767e8fe450683f30194dd8c2b87
SHA1: e8619c28bc1ffa38c8dc9cb643f7cc7dd87735eb
SHA256: 4670a331fdd0db6654c3e6f412a9da47f4f5922f59393edcdf2bd4b8f2f08461
SSDeep: 96:8hNOgiRc37Lh2M8EsUTw8GlXWc8aNoEXciuVXdcjF0Rjvcc9:8hNKR0dwd7NVutsc9
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll - Access, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 8254008843a6a323a17069d774783400
SHA1: 14e7a803ca7313614bb8ebf9caf46f40bdb8aec6
SHA256: 0e851ca644319797e3a5a3cfd53fa5bfed0f2bdb08ec07f7d149f8d58515ff77
SSDeep: 384:7himDuKyD8+mC2aUmPYgN7VpVxAtlgTqUmwXQExc7vcnujX80LDkuXBd1jnB/:1igLyfmC2OPYgVjfSlg4oJCzdkuXBd1x
ImpHash: None 		Access, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab - Access
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi - Access
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml - Access, Read
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1c8b34cf8f9df2b1d427c466263e0f03
SHA1: 60841cdd70a83522b582946df06298a8f74d39fb
SHA256: 6e637b764d76947707a72d64e131c67af0726f66d41f524e4d02bd7b8412064f
SSDeep: 192:GKLbhkj7oy8dcHXfEDd9UwPi4a4Mm4xc+oh0UcR:GKb62cHXfEDDUwPa4kw0PR
ImpHash: None 		Access, Write Dropped File
C:\pagefile.sys - Access
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL - Access, Read
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE - Access, Read
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1d7317e6f50f1f0b2c4627bf8d6ed645
SHA1: c31634702383e524ab55d7efef4c613a397bcdce
SHA256: fec6f8bc4d8e3ccb12011401805f2cd2dfb83254b400b213aad65fbf8524b7f3
SSDeep: 384:wPfZkah1oYh1qrJ3fLRUzqmpX/yRqh7V6yN:OuYh1q93jaOml/yRewyN
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decryptoperator@qq.com].cry MD5: f1b57f995c4424290ddf75b62992805d
SHA1: e94a03f9d7f973859b7ef5ef088dbc11d4cde537
SHA256: 258c60ce28f7018275377b12174c4f2d7e897cd1eb524dd0345dd21e4ce2eb92
SSDeep: 24:DZiO23vaSOLC61Bvp5Ud9q72DN0/22BVHBr2fxaMgzpDp3hCe4IJ2xdCStVcN:oO23SxC+7Ud9q7eW2QkxECe4RcN
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decryptoperator@qq.com].cry MD5: f350689d685a33247c8320508f7be884
SHA1: 4775f90bd0e24370e648f3768632595853ef625c
SHA256: 354cdb127d5e6aad71cec04d09471c291d6ca8cc115ef4a91e9bb88542d8967a
SSDeep: 24:vLcnTgAIZM74h/K0DqXEyqs1eHjr5iFpGlV9Vvw+r6JuoSQlJcsE62pNOAMZoxYq:Dc89ZMpsqRq4eDr5e6vw+r6JBlJzE8AV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decryptoperator@qq.com].cry MD5: aff5e47f4704a95a807b1b59992c665f
SHA1: b32074a86f2210fa752e9f84e6866f19aac6b503
SHA256: babb84d852dcb1169d9705bfd4811f38e883cb582229e01770075b5aa294fef4
SSDeep: 48:qMY2Fbnnqe21xikWaF3pu3iE+WDIdUQa3MaHzKkkacN:JY2FmrxL6thL3MEYacN
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml - Access, Read
C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui - Write
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui - Write
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll - Access
C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll - Access
C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll - Access
C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: 69902d844f1d5ea495c13a8a0f5c8abd
SHA1: 2bb92fce2d64f4818ef050283320d8fc386a1178
SHA256: 7f911af1adc9da79ecb03d555695e62cb00e480259cdcea220a3acaae3fe99a2
SSDeep: 24576:nzyc0opacbhmgk5gHL7a35AyjQgz9vzBA4rdeNkzfaZjBde5iPfsVOoejlwJf0x6:R0opH/cgHa3HRxz+4gUiZ9p2Oz5ouxUn
ImpHash: None 		Access, Read, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decryptoperator@qq.com].cry MD5: c13b9535dcf903ff531340a38408a996
SHA1: 8aad78365d0a62fb34ee37530d5208fd6b9fc4e1
SHA256: 4ddf505ea8a6ef0cbe45e87dc2f6ada3bb0041df297c736c9fa2c5896eafae9d
SSDeep: 48:M9jor0rDG47Or4X5Mpr+j+m59/0Tc22PL+jT5aP4gcV:qUr0/G47+r+jn59/0Tc22PLE57gcV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL - Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\LICLUA.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOICONS.EXE.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL - Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE - Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 17b09d9b52c16ecbbb42dc958147cf46
SHA1: ff80e0366070bcc03db55a20db60b05241c5544b
SHA256: 28f2de35d6278d2c729c5cb2268adbc2c6333df144f7c5a8068f6afec6faf3eb
SSDeep: 48:+LL4V/aQCawlGwElvsn1zUoDzoYvBgXidcn:G4VJwcla2WVtcn
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 19c5eb66d7372788a5556906271de404
SHA1: 9cbe343ca7dcfa286409593ade21c2ab72e8a06f
SHA256: def7e88012d67482f11c244b5fa5350910bc9aaac2bfa01250b362834f6c05e7
SSDeep: 24:AikwYgcenMbl72dqZpSgiCijFUX/kB2lVnMOD6jFWS2ANXUtVcZ:RkwxnM16qZo7UbmjP2ANXscZ
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 8a1cdb731239e65c8137e4e5db5c5b86
SHA1: 4e52488531930e3b33f0360b9e6e68dcee1afb82
SHA256: d00e787ef2b87333bc967b83dd5fbf4d0907d7e0eec701307546e8e6fe8bc709
SSDeep: 48:34K5sab/ERHvz5SQhQvVGhDk0MV716sDgSRytoiGTRpuiuCQyR4c/:IKSarAHvzgVvobKXTvDQyR4c/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: d3760d61850a4a9c125dec22a2b59f80
SHA1: 0d885541ba76f539d64e9f009321e98341cf9ab0
SHA256: f305f9877c9db45fb30bfe2d1eb825b4365044c07dd556b5a381cbf545e4686a
SSDeep: 24:yL+gqVZ+zd9Q0ntoM22JnLibfQkFkntwhmDcvUopAHXAuOXiZgNsY+9D70Av/dkM:RA2jQnL4onyQ4v5m3hOXwlJ70Av/d8cR
ImpHash: None 		Access, Read, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1cfab2c2636ca7b4c800e5d7d50dc728
SHA1: 0d83d37bafb9f2f8c71f53e988d1f28aacd16cd9
SHA256: c690af472cb6d721903b95ba77fcdd52b4c0c33ca7857866be95917978749a12
SSDeep: 48:aSRRwRjeivRRsVTQpo9eEgHANHe6m9y3qCMMsEE8hFXZwz+BwodjpWKgmc/:1w6aRSTMo9eEgHZ6e+5NFhvBvj0Kgmc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 6331e12d82cc0e59b543ccf271549f28
SHA1: 464334f7248aad0a2496d05d27b61b46b7a76fd2
SHA256: 381270de72ec23ffba3c96c5e7096a0cdcca90d8e1e448f68560a8bf0dd9010b
SSDeep: 24:vPRgOwoGN1eIn7hIOdhdrMIjOzAEyNljblI43N3XgtVcn:vpTjGZtrMIjOzAhNtblIORIcn
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 1a06446ef88c17abc4dd36579c45856f
SHA1: 0725f74007ea5f091f1ab37c0839e89a9a084a5b
SHA256: be096467a69044f2a42e215df370e1603272095b449f7dd5d7cb1dc278c3409a
SSDeep: 48:WawoAwsp1StJ3L9zZGQLuvnjtedNmfG8wc/:Waw7wspEJ79hLuvnhwc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3f86cd37adfea6d4da7c3ec682426c60
SHA1: 09719fef77e0a9dce95b30dc025fd278538a0d61
SHA256: d1d5f019021a66b40def1540ba278ba662dd372b5ede5da15f1899d22365642a
SSDeep: 24:KtfWPQDTY6QuKztNQxbGP3bGkIaClpmsfaMGdrAT4z/FVKJ1eWpFT3btVcD:KtmQXOu6OxSzsaClpN4u4zETcD
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 8d0851e746e855726a9201af35756311
SHA1: 7200399ab39e338b00e1eef4f4cdbcfb6d7ee890
SHA256: ceb220497825516bc53e19af199b2a56446922e7f0671d8d04841a779b7972b3
SSDeep: 48:ql3xVXEaR+vOYtZwqXLIuS/HSeyJdE6MQlwFMpKc/:A1QlLIuSHSPTpWqYc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0c2968dc4fb120c72e922a1c48b5793d
SHA1: 91f2ff064b0c3075a5714df387889062bb12db71
SHA256: 7f1a8b2005eef3537eb5390a76164d0d6a08d5d7a3b2bcb3e75d8decd6ee1ab2
SSDeep: 12288:WhDRpJFVLYnU4698rNVwx3BXxDGkP+4cUj4yWu2aJMXzjIFOLPVS5:WZL9oI3V9HPZcUj4yWzcMjjak2
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: 207e894c1617d9515e64763562f678d8
SHA1: 5460594594cc2ee7eac2863fe3403fecd92aedef
SHA256: 203a630070a7121aa6ea0a0afb691f0eefda565113030c69d183905d5e7efc60
SSDeep: 1536:vpSnTk/zaYFmWbY0lKrapwtYyPh3Aj4Z2NXxr1SWZu11G/BT:vEnTCWm1MQK+p+h3AUgNVUWZu1EBT
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: ea76142c868055278abd99ae6ef859d8
SHA1: ce7ce9824850ee08f9327659a52ef24f09e97c8f
SHA256: 085c7657d8fd215945ce11223fccc79f39ea9840c1c32fbcee038e52e02c40bd
SSDeep: 96:XcE6a7pPtVw9/gzHZ0+FQyB/PSuwq0FRbPsGh2krhhzWOhTrqDZrtua6VSMJk91z:XtP769/d+t6uuzh2cz7hT+1MaISm4e3+
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0af7af35e6eebba4e7c80e0b167bace0
SHA1: 4dad35a786c168672b82675542f5d794726740e8
SHA256: f9b078701b19c1040b08b8b747042eb02ca5aa9140598d72e667ce81595e7c4a
SSDeep: 24:kZqWVYe4ctIkCp0guAoToIqti/YytOZTW5MUtmMx99S2zhtVcZ:A4eTEp0guAgrOQ5tf5S2zRcZ
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: b711ab63ee2c252419b719b405386fd6
SHA1: 2535f3c0947af7dc935b2493ae56be286424bcd2
SHA256: 8475ed5250cf406117ec003e5b452c019676bbb9e05560768a6612da8f852691
SSDeep: 768:5qbyWS53awO07Dob0kwfh+faEtTSBgG9pmPfFXl7V1C/KaR:5qGWS5ApI0fa6TukFV7VRaR
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: ca4b82360e39f86861b37ee41409a6c1
SHA1: 53f52e58e27759aff4e9d9f184ef10f9006d56a4
SHA256: 74ed18a3e13358bc031e29384b62c9c503b2d2346a9c523d5d95a0dfb0b735e2
SSDeep: 768:oCGKkF58L7nkPvC5PwhkdQNjiBsteUXNsAFJVV:0F5bPvcDGSFcV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: a1b61d50e70b6479e364722465e0706c
SHA1: d4910d8f2344e9b31f3cfbabf40fa891901614e9
SHA256: 7b697384d5004eb53bdb1cbdd6b6e9bf1581eaa7dee11f4d919d161459f5dfd4
SSDeep: 768:fuKumz4huydl8IX8AQQCscjs4Jzp8mudwV:fuyz6uNIX87Fbs4NymueV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decryptoperator@qq.com].cry MD5: bdc241afc790c806735304a627dabdcb
SHA1: 2d1d853590ac88b7f04d858518ca6816cfb6a60b
SHA256: 8642a6a90e809e32602b06bb13fda0e873a71eab7b4409603cf134a5d1c2581e
SSDeep: 1536:XWnzSc2NEhBkgox/rfcG0ZCxzauowp0PpfiSiod+Ivi6751/:YSc2NE0goxjr0ZS1pqpqTod+ITL/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: e48150c11973c885d6c959fe869f0e7d
SHA1: e893b60d38932e4647448800599ae4774243f5ac
SHA256: d8091bb768d8a8ee7043eb51a8a5cf98ff55a4cc81231b9415499ae446310efd
SSDeep: 192:lMo9PU0boJkeTNVwxDshS+bnlWi6PNutiSPQ+EzzrL8tOOHmc/:NUjDVwx7kZ6lutiuh0zbON/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 223c1e7be67176eaea1f4e63378670fd
SHA1: 72c50151c5825aeb5aaf1e64fae0ebb71163ce55
SHA256: 541836775b994ea081f2c726fec7496a5bf5a8a43216dc236f337ffd971ea046
SSDeep: 24:gHg9oyEO4K56TsfD6fY9sXjXcwb/ZYEPpY9LvykPXiwBYSXe8x2wO1dCuQrk2lRH:gAZ6Yb6esXxHpSvyLwmSX61er12cD
ImpHash: None 		Access Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3552bb186963e9a1db4f63b3353d5a63
SHA1: 069382125e081486cf21fbb3dc806c3a67386335
SHA256: 0a9a555645db21db83cdd064f9eb1906a3e4dea458086075d013bbf3fb2affa4
SSDeep: 48:JiB1XEoK3ju/hig8JnS8YPYzo5qvBsGCjGEKCfBtrUzSjEPcHXawqj5rFq8jc/:0zXEPzLN1S8Ygzgq5hFDujV3aPfq8jc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 8cda8f5faf6d24140dbb5a6ee1864211
SHA1: 19d8d772cfd3694b3ecd105aff7f2f27420005e5
SHA256: 31a8efd08c79b52f691186e5b40cab40f33c442145103bed5e73d8fbb5fdb6df
SSDeep: 96:RZj6bqN3p8Mq/vBMTToEPrpHGbw9gtaxnA3lAznqL6X6YyfHc9:RZj6m1uL0MElgw9gQxnA3yzqL6JyfHc9
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 452caf9394d385bd5e99995985864ffb
SHA1: db595f451c73210b62553763404ecbb3bbde583a
SHA256: f23b93c79cb393a2a1d39667091cf51fa9a7498b55bfaaf7061b3e9d87c23d0b
SSDeep: 24:fR1XMSZ88agPSo4JEppsMhD2z5fWFyFa2C+ffFCAbxN830c71UM2jpMz+07/FlK4:vXpPhGEpp6V+MJ1E3vKM2q+UFcupD+c9
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 3316833d982aeaa2442811ef21ab76b1
SHA1: d7d0adade04fada6a73eb5c5c8510f9f0aa06c11
SHA256: 70e873d84f53d2aacc158cb0a4e123b53650d9673b189592aa0a38edae26bd98
SSDeep: 48:3/bXjq0u8nXts8f/C+XbIUSmpWcrXqOIELYpGFc/:3Lg89s4C+rV0oXqOIELZFc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: f434f208ecbc883fc6b494a4a693f383
SHA1: 837366e104247b0942a1c81fe31a932290ae6e2f
SHA256: e8318ea37b8060da8de1a8253f92e4eeea094ff8aec363c0fedc2fa653c76ffb
SSDeep: 96:YevLWaG1LvMiM2FvK0w6DihYWu37sQd6GKfMKc9:YkL+LvMiM9DICQ7szRDc9
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 79b66f0262f6aef34574ea34d5d7018b
SHA1: 67b2d26eef6dda3b7a6015dabdddfdeb576ba9ea
SHA256: 0e25d3ce9285f4f62c0a4bfc5b4360a7c6f374e78c812c36e092ba9029a47f6c
SSDeep: 96:xLBQJjwVWilf+SZMeZaF0uCu7Gn9WxLAMpo/Tc/:xNQJjEfx+qMeluCuasTSLc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 31021b3d70e5fe07e2908e479e6fae7d
SHA1: e2d02200b267837c94521a5d1b463b044233dc47
SHA256: 7efeaff35c41d660def591913033e0c8cdd00a6780b0228727fdabf5e687ae14
SSDeep: 48:WyysQEDOEFECEYlMZnIISWUEJIQkYRy4dtjUcv:iCEYlMmxzUMYRNocv
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0abf47dd866a88fc3f31f42dc37080e2
SHA1: 925a877b0180f6aa8d29c185cc9569380c95d905
SHA256: 8506c4b79e35e0963a80df7d124a866746a09c9e4105edd48e830ca814ad066e
SSDeep: 48:LC14ceOcEHjJiIVuvQVA1PtERhvQOaXYtGRnunOR7wCKNoVc/:O14cFcE9BV5DQV8OnMOyCKNoVc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 94d0a59f1344802ded0beaf648e11e90
SHA1: 968726de7f52a2d8cf339e03d4b15ff8d948328d
SHA256: 320ab524ded7d2725cab5c13026c1357397d6f9a51e4b08b0212891218a993ef
SSDeep: 192:La01+Ii/IpeP+wL3QorhxoV4AY5B1osvy1oaaNyThJWcn:L3bipP/zNoVZaBneRhbn
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: f9c097257e364e9b817d69906959d963
SHA1: 252b1e266a2c92d00370c3ce9e46803e1a006764
SHA256: 902063b472f9c152bbb26ea42a23a73abb266c5cb99cd0928eb438ebaca0e1fc
SSDeep: 384:MrNjE3oe3g5UtN522i/kBGmSijGR3tmnnw34Bfpwc/:MrW3Y5UtN5nU0Gmw4BRwc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: b4fedd797f34502a73049c1a5b738a7b
SHA1: 76afc250af91e02b33d7391ebbed2422c50c5225
SHA256: 0e85438f209d3c191ef2018285b606cf390aa6bb6ecd852c304fb5072ffb9e8e
SSDeep: 24:2gWsC1ItlY0ZqI0AFeSOkvCkT2ifD8ZxlrCFVqZxF87j1ciuoGCV8Z3uZc5ltVc9:QR+tleALLT2irU3qgOxGCV8kZc5Fc9
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: e2ffa35ef38e0a738326a0856739a679
SHA1: c1498e9491c571cf896221b5526ce8f91ffa0616
SHA256: f05bd282dacb8175f4891a92a64f2603d13f8d33b340576909f393758e699207
SSDeep: 48:OmLidRw7DUzXj1kOjT0nD9JCH+obS314zMTlS8//uUM4e8c/:LLisHAja5D9JCH924wTlzu54e8c/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: be5eb3d61d93aa74177aed4f1936e23d
SHA1: 4be550919457fa5f60ab7c3a1699220616c698bb
SHA256: 39059acf1502ba8a601b6e5f54f9df960483eb2cdf12cad174ae2c1f045afdf4
SSDeep: 48:Ms6jTI6bQQLNjwcQF1ovrCvYgLcNa/uvwHfGzu8sc/:AjXb/L6cy1kgLN2vw/GzOc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 992a2a574f7b6b1491c13ac7de082d88
SHA1: 1147dc80a8dd3019b34bf6568ad77e0a8e92e36e
SHA256: a5868b8a7caf7c00c13d7c9037a33a9fc35e967cde46015f4205b274824ab55f
SSDeep: 24:WHg7DYzfFp15IuKyRn8qK2nN8/xihryH631cEmsXqlqpf/GEd3rOsd0QAQ+ftVc/:jfYzfFi+1N8JADbmsmqlGEVrOss1c/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 64cf47f9b5910e09dac99127b8c3ec9c
SHA1: 27cdfef6b0ee5781ee96e51c9393dbc020805442
SHA256: dce3de0ec318e4bf52a0df91e1c0108ea7286691d5c6e0c0d73ac528621e5924
SSDeep: 48:XKCIOtAlJVBuha4lCYb8WgLieRl+C5G8ALlEsmYc/:jOVCZd712+UZALlEQc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 5bb99e25fb356414128bd88ede809c97
SHA1: 2f68996963223b1b69c8ba858b327e49956e2583
SHA256: e4f462f26ae004961629366fba1f4ea706dd7f4b2521c0271d9dfd7e3f6c5e2a
SSDeep: 24:bODB7ZUdMMecey7XyuB+0yfGSTcfRw/tVcTt:b0BNfXuBRSTI0cR
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: cf6c283fdbc1de17445218ac037c9931
SHA1: dad4fb6d9cfbbab7eafd7a59c60367cb844cdca7
SHA256: aa5a72ffcd2e745787f921bd69fb3af3d94deaff948d2e7822ff9498430fb45b
SSDeep: 96:L6H1fKL/3ot4knfMRgXDRhv6S6RylKeJLfe75bdd72tnZl4sUwMKdWtBfHM1XRan:L6Vf+/4dMSv6NIJmVbddSnr4scACHELm
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 421ddf7a2881eb649ccb782744c95971
SHA1: 35920c8987bf62eddcf4a3bb9f82093c2a1b8a11
SHA256: 296d9cb50dc33c7354f0b046fcd7379ac9148fc979d4d42daad6899da1d1f46b
SSDeep: 384:OwVWNRXOgVfkDz3cKd/EZWpWsDUQ4SF82y+I6FoLcfEbSLFeQ9:Ow0fllkzMC/E8MK8LSWIEuBR9
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: dae66c3b7dcd21ac51a8dee7f4601b31
SHA1: 7eef1f3c23e6b49b2412d82843a1e9cd9fd09a04
SHA256: c09648b74cdc5130cea6e530a9914300bfe49df52e35b41a70e0926883c1207b
SSDeep: 768:UaOj0VTYQkV/ct88lztfxL3/U5vcMpmD7Tl+VjXk1/:tOj0VTJkVE7/xb85vcMa7hSXk1/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 79ed19269358e5410408f4d942ccdfe3
SHA1: c3c818fcf97824b8b75b579e17da956e37c17cdd
SHA256: 02705c260199dc317b52ca70915a62bae45e4d63d6ff3694be222bbe717ec8d0
SSDeep: 24:k/0xC+OVt6dSdIy2ghJaNcVfuUhbIoohl6WCGFXKlZ5rOgqYFotU0ynpzZIollsz:lC+Oj6Hy2ghUc1kJyqYFot04jpccZ
ImpHash: None 		Access, Read, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 9fede4fc96d79f71d9dbe917984acd2a
SHA1: b67be3f93bff5a8a8f2d4ed8817f39112be027f4
SHA256: 4eef97e033d1419b0053f662aeebc98990f4a1f4926b1070b6892e03229c1bed
SSDeep: 24:O+tcrgElBTwzd9p/zxcr0V2DTvvMrP4dlUdlW1O5umAvjwqS+jUB+86gYyVSpft8:Vc84spL/zOr0QD7MSyxumAPOQbXc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: be2f61bb6b495d84cd6cccc0ffef2499
SHA1: d1779b847fa6c6cc7e119914977a127b799ebdfe
SHA256: 2e1f641ccfdd6f0e431eb085c18938127684d4c8b670c161e12f59c6ce7b7601
SSDeep: 192:w6s4J0GtinjaZjWHF2hYjWLfw6pNlLPfrc/:xsWLkjaZRCWLfjHfQ/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 0ea65d9e635b23008a67fa298d581396
SHA1: 6ffe61fcad87164404405ddf3c14a297dcff16a3
SHA256: b56720aab6d82bd5d17eb385e50cdf8ae4a0241058f950156d838e760f93d3a6
SSDeep: 192:4uaObpZMNC4NOHr2JbkCp2KKp8v6FqRD6pVy8yEAywI9FfKzuMKjRHHcR:4uaimCwYrhd8v6kKVXyEALtuMK98R
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 949d367abc06ed742274431d0d2b1de3
SHA1: 559251c001fe02b0aeeff1a89a54b7f9a257ab28
SHA256: 23ca24a2b4518cab59c89528507196a20846d94a23108f29325ec07e6bf7b798
SSDeep: 384:6ru9zUPcgZTPJ63VBiHbhRF0iRB6H/cD9Ty3BIvMYXNTz8tvRw1KDVZ8SSU/:T3ETx0AbhR+OG3BIvVwi6B/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 92d232900f65bb61d5dfd673cdbc1be2
SHA1: 2222533782516f3a55e9cfe45fe9af743a29a65b
SHA256: eb154475bc47135df30ff30c0b15a977a1850c7e7c496eaf42b6369e65019e92
SSDeep: 192:hBcS4y+YdwMbajLVOqUHXQ6RegjH8fvtdC/POu/cR:hBL4yHGMbajLVOqU3vRfjcXtdCfER
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 65ac4562333712508fa94f0f7f0d162c
SHA1: c082dd32cb99ea5765c0c51c18f8928e27f02f0d
SHA256: aa77ccb190749f33172d430941671448f787881c75d933e06a70c1863e0078d5
SSDeep: 48:Yt4C7myadiZ4BQGvPIzZjYNr3ptzdRMgAK6rc+QtllgYhdec/:IVCtd5wzZAr3pJdRMfRAkgdec/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 12c6fcc261d984b487461cfd79fb6a6f
SHA1: c3fb26e0dcfc6336ea926f838da55093898d7731
SHA256: 4030f3f7e4f309c3663a2e082607208d0739741174586d40d3137266a9b7ce37
SSDeep: 48:HCo025ZP0rWxAHXrQC0UN914hyZOIIoc7:v0YZP0rkA3rQsNHBZtc7
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[decryptoperator@qq.com].cry MD5: 7f3b4316e2f9da03f63c5083f9d80a64
SHA1: 278b84760a85f79b5e2f003054f48f25c2fc70ce
SHA256: 0e0c0a11d3258218ceddb1ebe2ba724f785975689f1cd9b622ef1fc8bc25fb41
SSDeep: 192:gJwdDU6SDvnpgU1O+jMtTfGL2u7irTqsp4QlaqqZYsVI+6zal6FDZiusnsPSiGxz:gWdDU6SLpgU14eyzqQ4QlaqqCsVI+q6P
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML - Access
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 4d8cc00fc954583e059ddae5f05d0fbc
SHA1: 16e4918c5b70b4763764ad187e69a110122ec535
SHA256: 448d90537c42b939f172a500ebac933cff9cfe97a7a1f238f4a4a933792ff588
SSDeep: 192:01+eh9Qlsx/uvjr6fcBqmjKNqDjwd6Kdax9XEGSa8kwAe5uN+hjoP6c/:UTQA/uvCQKNqDUpMT0GJ8NFINajoJ/
ImpHash: None 		Access Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 73ce4b1cc0967cfd97f86722174c0b4a
SHA1: c7bbd2959339ef6ea8bd4864cc24843ac08fc589
SHA256: 6aae85d49501bc1a2bcbf7d4a69371fd15f6ee37b4423fe737872400b8a69301
SSDeep: 48:Q1Ll0Si7hKs+Xo88fI8o7XRugLyq2oOlL6dyNmTujc/:Q8x8IKR5ahluQjc/
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[decryptoperator@qq.com].cry MD5: d71f29a920dde31d1e49b48dac230c0b
SHA1: 83f75bf87817bd2afd7a98ef2e3401003e2e3193
SHA256: 398d5de967df2a3c3dd348a6705e4d5bd57f2c827f8934f38785fffba6e1d2da
SSDeep: 768:UIy5L6BOpfuVsyU5t0pDbtocCUpUhYSdL5Qd2/ntoK+crqW5n6uI2df0lNUV:qL6EK25t0scVQ5Yc+K+cOmn1I2doOV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 06f7ca124e096b1fe207a372d0398cf0
SHA1: f079e33e1d93a3099ce92aaa8619cb4be00cbe12
SHA256: 6ae7bba2748f36ebc57bd8f711d261bbc3aaab5c733c6167ccf67b50cf1e93ad
SSDeep: 48:QJeeRoiXKP0bGeoYdHaWzJO8pwwJOFBxDf5Er4OSV5/yodTpcAfIkwctGJLnOTcV:qeeRrzHHPz2mOFjf55OsDTpwvwcV
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[decryptoperator@qq.com].cry MD5: 344c53e507381ccedf676c3d948194ca
SHA1: fd86a231c688ef84414f1a9f8c67c5b368ac9319
SHA256: 43275b81c4835ae4ea80791dda786a63fb0d22d67f370c3d2982819f8f5c6af7
SSDeep: 192:udW/uaJkoIAMmMaaW14eC/eqK5kEOsLsjGk04ZOXVEGz7nots7LPaxAJK+vYHb6f:uU/wnAMmgeSKu7sYD04U/zsePP8AE+Ye
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[decryptoperator@qq.com].cry MD5: 7e0c852430a2bf70d25030839ede90a7
SHA1: 3e3f5187aac640de592b42f8b67eb554b923df70
SHA256: 66ac8cf24602ba3ca86ceab1f5f61cc37625afe6f65a2e658168708a80cc4f8a
SSDeep: 6144:zQXTi7IE70jNoV4ttS3fRMgGuHIB16aH0k:Gu7IYLVatS35MgjHsb
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[decryptoperator@qq.com].cry MD5: 990f5e4154075f685212e2427f04ac65
SHA1: 00aae015306f878143d85436db69cb7a97b72974
SHA256: e834de2005ebae093b579341e517f88a31d929557d55e428ce3c99167e39e9af
SSDeep: 24576:pf9rBGp2+bscA9Eq6r1G/ju0n8ccM6bG1WrevdHMaWr15F9jGHAnmcgW:rBabsX9EqE66vX7ev4r116oJgW
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry MD5: 65b923effa2fca1d5b71abd9b7bdba5c
SHA1: 9ea56cd5b1c95de7ba68d97fe8099f94ecf47096
SHA256: f4389f1a4d6a52791eb2cad56f44e0e0a5f1bebfe1e312143e008de167d0727f
SSDeep: 24:CKOiAiKnfK7lTwxGsAiKqHnM2mHkwqG0HtVc7:CpXiyy7lMYhjqHnMbEwqGuc7
ImpHash: None 		Access, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf - Access, Read
C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF - Access
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\PREVIEW.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG - Access, Read
C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM - Access
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM - Access, Read
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM - Access
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config - Access
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG - Access
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Common Files\Services\verisign.bmp - Access, Read
C:\Program Files\Common Files\Services\verisign.bmp.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\System\ado\adovbs.inc - Access
C:\Program Files\Common Files\System\ado\adovbs.inc.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\System\msadc\adcjavas.inc - Access
C:\Program Files\Common Files\System\msadc\adcjavas.inc.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\System\msadc\adcvbs.inc - Access
C:\Program Files\Common Files\System\msadc\adcvbs.inc.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc - Access, Read
C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\desktop.ini - Access, Read
C:\Program Files\desktop.ini.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\DVD Maker\Shared\DissolveAnother.png - Access
C:\Program Files\DVD Maker\Shared\DissolveAnother.png.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png - Access, Write
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv - Access, Read
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv - Access
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl - Access
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl - Access
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl - Access, Read
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl - Access
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl - Access, Read
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl - Access
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl - Access, Read
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl - Access, Read
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Read, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF - Access
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF - Access, Read
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.id-9C354B42.[decryptoperator@qq.com].cry - Access, Write
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe MD5: 1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17
SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW
ImpHash: None 		Access, Write Dropped File
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe MD5: 1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17
SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW
ImpHash: None 		Access, Write Dropped File
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop - Access
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe MD5: 1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17
SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW
ImpHash: None 		Access, Read Sample File
C:\Windows\System32\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe MD5: 1d89a80960eecea13f473366220de282
SHA1: 99f67780a721330637fa361c849df514d21abd17
SHA256: 9c63223d5cc284ed38c982e4dd7e292289b96a836f4fd472e57a6803976b96b9
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4ANhW/Q3Im4A3N5rIIWC6OKLHaP:Qw+asqN5aW/hLHhW44hA7rl4fW
ImpHash: None 		Access, Write Dropped File
Registry (24)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\cprogramdatamicrosoftwindowsstart menuprogramsstartuppayload2.exe Write
Mutex (2)
»
Mutex Name Operations
Global\syncronize_2DWHU4A Access
Global\syncronize_2DWHU4U Access
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image