Technical Information
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<LS_APPDATA>\<File name>.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<LS_APPDATA>\<File name>.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
- <Drive name for removable media>:\utorrent.exe
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
- \KnownDlls
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\symbol.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\centeuro.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\corpchar.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\croatian.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\cyrillic.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\greek.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\roman.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1253.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\romanian.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\symbol.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\turkish.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\ukraine.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1250.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1251.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1252.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\icu\icudt26l.dat.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\iceland.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zy______.pfm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\tr.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\rss.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_issue.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_lg.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_ok.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\stop_collection_data.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\submission_history.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\tl.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\trash.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\sy______.pfm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationinacrobat.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationintray.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationinacrobat.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationintray.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\warning.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\readme.htm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\enutxt.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zx______.pfm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1254.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1257.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1258.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\hyph_en_us.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dummy.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\added.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\en_us.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\excluded.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\java\java update\task.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\java\java update\task64.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.eps.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.jpg.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.png.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\adobe\products.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_ca.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\hyph_en_ca.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\en_gb.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\hyph_en_gb.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\en_ca.dic.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_shared.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\help\dexplore.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_same_reviewers.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_browser.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\branding.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\setup.chm.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- <LS_APPDATA>\<File name>.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- C:\autoexec.bat.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\config.sys.id[bdebdabe-1096].[lockhelp@qq.com].acute
- D:\$recycle.bin\s-1-5-21-2922372159-162323534-3872807762-1001\desktop.ini.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\ose.exe.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\$recycle.bin\s-1-5-21-2922372159-162323534-3872807762-1001\desktop.ini.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_initiator.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\ended_review_or_form.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\end_review.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_distributed.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_received.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_super.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\distribute_form.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_all.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\form_responses.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\open_original_form.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\pdf.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviewers.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_joined.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_sent.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_super.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\info.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\main.css.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.exe.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\create_form.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\br.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\agmgpuoptin.ini.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\adobeid.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\defaultid.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\javascripts\jsbytecodewin.bin.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\eula.ini.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\license.html.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pdfsigqformalrep.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\signhere.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\words.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pmd.cer.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\rtc.der.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\add_reviewer.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\bl.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\dynamic.pdf.id[bdebdabe-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_email.gif.id[bdebdabe-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\setup.xml.id[bdebdabe-1096].[lockhelp@qq.com].acute
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv