| File behavior |
| Behavior description: | 写权限映射文件 |
| details: | Global\Cor_Private_IPCBlock_v4_416 |
| Global\Cor_SxSPublic_IPCBlock_416 |
| CiceroSharedMemDefaultS-* |
| Behavior description: | 查找文件 |
| details: | FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.INI |
| FileName = C:\DOCUME~1 |
| FileName = C:\DOCUME~1\ADMINI~1 |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp% |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445634808.611200.exe |
| FileName = C:\Documents and Settings\ADMINI~1 |
| FileName = C:\Documents and Settings\Administrator\LOCALS~1 |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\996E.INI |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI |
| FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.INI |
HOME
