Technical Information
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<LS_APPDATA>\<File name>.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<LS_APPDATA>\<File name>.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
- <Drive name for removable media>:\utorrent.exe
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
- <LS_APPDATA>\<File name>.exe
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dummy.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\added.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\excluded.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\java\java update\task.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\java\java update\task64.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.eps.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\en_us.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\hyph_en_us.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\help\dexplore.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\360tray\360tray.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2cmd\a2cmd.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2guard\a2guard.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2hijackfree\a2hijackfree.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2scan\a2scan.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2service\a2service.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2start\a2start.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2upd\a2upd.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.jpg.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\microsoft shared\grphflt\ms.png.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\aavshield\aavshield.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1251.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1252.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1253.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1254.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1257.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1258.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_ca.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\adobe\products.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\en_ca.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\hyph_en_ca.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\en_gb.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\hyph_en_gb.dic.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\a2wizard\a2wizard.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1250.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\tl.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\about\about.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\icucnv40.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\icudt40.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\jp2klib.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\logsession.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\logtransport2.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\onix32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pdfprevhndlr.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pe.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\accessibility.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\adobepdf.xdc.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\adobepdf417.pmp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\datamatrix.pmp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\qrcode.pmp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ace.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\digsig.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\dva.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\checkers.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ebook.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ia32.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\flash.mpp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\mcimpp.mpp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\quicktime.mpp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\windowsmedia.mpp.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\pddom.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\readoutloud.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\reflow.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\extendscript.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\ukraine.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\osetupui.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\cryptocme.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\ackwin32\ackwin32.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\esl\aiodlite.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\a3dutils.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrobroker.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrofx32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrord32.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrord32info.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrordif.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\acrotextextractor.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\adobe.reader.dependencies.manifest.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\adobecollabsync.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\adobelinguistic.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\adoberfp.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\adobexmp.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ahclient.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\air\nppdf32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\arh.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\axe8sharedexpat.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\axsle.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\bib.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\bibutils.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\browser\nppdf32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ccme_asym.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ccme_base.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ccme_base_non_fips.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ccme_ecc.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\ccme_ecdrbg.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\cryptocme.sig.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\admunch\admunch.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\turkish.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\symbol.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\setup.chm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\agmgpuoptin.ini.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\adobeid.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\defaultid.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\javascripts\jsbytecodewin.bin.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\eula.ini.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\license.html.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pdfsigqformalrep.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\dynamic.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\signhere.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\words.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\pmd.cer.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\rtc.der.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\add_reviewer.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\bl.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\br.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\branding.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\saveasrtf.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\create_form.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\autoexec.bat.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\config.sys.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\ose.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\$recycle.bin\s-1-5-21-2922372159-162323534-3872807762-1001\desktop.ini.id[5b158ad1-1096].[lockhelp@qq.com].acute
- D:\$recycle.bin\s-1-5-21-2922372159-162323534-3872807762-1001\desktop.ini.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\eula.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\distribute_form.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationintray.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationinacrobat.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationintray.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\warning.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\readme.htm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\enutxt.pdf.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\sy______.pfm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zx______.pfm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zy______.pfm.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\1033\dwintl20.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\icu\icudt26l.dat.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\symbol.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dw20.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dwdcw20.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\dwtrig20.exe.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\centeuro.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\microsoft.vc90.crt.manifest.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\corpchar.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\msvcr90.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\croatian.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\cyrillic.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\greek.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\iceland.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\roman.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\romanian.txt.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_all.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationinacrobat.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_initiator.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\trash.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\ended_review_or_form.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\end_review.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_distributed.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_received.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_super.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\form_responses.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\info.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\main.css.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\open_original_form.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\pdf.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviewers.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_joined.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_sent.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_super.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_browser.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_email.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_same_reviewers.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_shared.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\rss.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_issue.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_lg.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_ok.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\stop_collection_data.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\submission_history.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\tracker\tr.gif.id[5b158ad1-1096].[lockhelp@qq.com].acute
- %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\search.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\acrord32.dll to %ProgramFiles%\adobe\reader 11.0\reader\acrord32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\agm.dll to %ProgramFiles%\adobe\reader 11.0\reader\agm.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\cooltype.dll to %ProgramFiles%\adobe\reader 11.0\reader\cooltype.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\npswf32.dll to %ProgramFiles%\adobe\reader 11.0\reader\npswf32.dll.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform.api to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annots.api to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annots.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\escript.api to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\escript.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\makeaccessible.api to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\makeaccessible.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ppklite.api to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ppklite.api.id[5b158ad1-1096].[lockhelp@qq.com].acute
- from %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prcr.x3d to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prcr.x3d.id[5b158ad1-1096].[lockhelp@qq.com].acute
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv