1 File(s) 15,815,555 bytes
Directory of C:\bkeab\x86_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7
600.16385_none_c2e0c60973f54ddd
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 392,704 imapi2.dll
1 File(s) 392,704 bytes
Directory of C:\bkeab\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1
.7600.16385_none_fde3cf3dd3e16d0d
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 12,498 append.exe
1 File(s) 12,498 bytes
Directory of C:\bkeab\x86_microsoft-windows-s..inboxgames-shanghai_31bf3856ad36
4e35_6.1.7600.16385_none_c07a51d9507d9398
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 13,713,920 Mahjong.dll
1 File(s) 13,713,920 bytes
Directory of C:\bkeab\x86_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.
1.7600.16385_none_1ce85d64ba8de34d
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 9,612,800 SBEServer.exe
1 File(s) 9,612,800 bytes
Directory of C:\bkeab\x86_prnca00c.inf_31bf3856ad364e35_6.1.7600.16385_none_81a
95de83e30c269
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 18,247 prnca00c.cat
1 File(s) 18,247 bytes
Directory of C:\bkeab\x86_prngt002.inf_31bf3856ad364e35_6.1.7600.16385_none_438
5b19c13e02499
03/23/2013 10:01 AM <DIR> .
03/23/2013 10:01 AM <DIR> ..
03/23/2013 10:01 AM 20,085 prngt002.cat
1 File(s) 20,085 bytes
Total Files Listed:
8 File(s) 39,612,945 bytes
26 Dir(s) 13,959,536,640 bytes free
C:\Windows\system32>DIR C:\Windows\IMTCS.IMD /S
Volume in drive C has no label.
Volume Serial Number is AE3A-BF9E
Directory of C:\Windows\IME\IMETC10\DICTS
03/23/2013 10:01 AM 15,815,555 IMTCS.IMD
1 File(s) 15,815,555 bytes
Directory of C:\Windows\winsxs\bkeab\x86_microsoft-windows-i..se-bigramdictiona
ry_31bf3856ad364e35_6.1.7600.16385_none_8e296a1361001015
03/20/2013 03:37 PM 15,815,555 IMTCS.IMD
1 File(s) 15,815,555 bytes
Directory of C:\Windows\winsxs\x86_microsoft-windows-i..se-bigramdictionary_31b
f3856ad364e35_6.1.7600.16385_none_8e296a1361001015
03/23/2013 10:01 AM 15,815,555 IMTCS.IMD
1 File(s) 15,815,555 bytes
Total Files Listed:
3 File(s) 47,446,665 bytes
0 Dir(s) 13,959,536,640 bytes free
C:\Windows\system32>ICACLS C:\Windows\Mahjong.dll /T
C:\Windows\System32\LogFiles\WMI\RtBackup\*: Access is denied.
Successfully processed 0 files; Failed processing 1 files
C:\Windows\system32>ICACLS C:\bkeab /T
C:\bkeab BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-i..nspection.resources_31bf3856ad364e35_9.4.8112.
16421_en-us_a467a79f94926dbf BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-i..se-bigramdictionary_31bf3856ad364e35_6.1.7600.
16385_none_8e296a1361001015 BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7600.16385_none
_c2e0c60973f54ddd BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_no
ne_fde3cf3dd3e16d0d BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.
16385_none_c07a51d9507d9398 BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7600.16385_n
one_1ce85d64ba8de34d BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_prnca00c.inf_31bf3856ad364e35_6.1.7600.16385_none_81a95de83e30c269
BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_prngt002.inf_31bf3856ad364e35_6.1.7600.16385_none_4385b19c13e02499
BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
NT AUTHORITY\Authenticated Users

I)(OI)(CI)(IO)(M)
C:\bkeab\x86_microsoft-windows-i..nspection.resources_31bf3856ad364e35_9.4.8112.
16421_en-us_a467a79f94926dbf\networkinspection.dll.mui BUILTIN\Administrators

I
)(F)
NT AUTHORITY\SYSTEM

I)(F
)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticate
d Users

I)(M)
C:\bkeab\x86_microsoft-windows-i..se-bigramdictionary_31bf3856ad364e35_6.1.7600.
16385_none_8e296a1361001015\IMTCS.IMD BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7600.16385_none
_c2e0c60973f54ddd\imapi2.dll BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_no
ne_fde3cf3dd3e16d0d\append.exe BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.
16385_none_c07a51d9507d9398\Mahjong.dll BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7600.16385_n
one_1ce85d64ba8de34d\SBEServer.exe BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_prnca00c.inf_31bf3856ad364e35_6.1.7600.16385_none_81a95de83e30c269\
prnca00c.cat BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
C:\bkeab\x86_prngt002.inf_31bf3856ad364e35_6.1.7600.16385_none_4385b19c13e02499\
prngt002.cat BUILTIN\Administrators

I)(F)
NT AUTHORITY\SYSTEM

I)(F)
BUILTIN\Users

I)(RX)
NT AUTHORITY\Authenticated Users

I)(M)
Successfully processed 17 files; Failed processing 0 files
C:\Windows\system32>ICACLS C:\Windows\IMTCS.IMD /T
C:\Windows\IME\IMETC10\DICTS\IMTCS.IMD NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)
C:\Windows\System32\LogFiles\WMI\RtBackup\*: Access is denied.
Successfully processed 1 files; Failed processing 1 files
C:\Windows\system32>
i believe this is everything that i got..