Analysis
-
max time kernel
154s -
max time network
77s -
platform
windows7_x64 -
resource
win7 -
submitted
11-08-2020 12:30
General
-
Target
foo/383497fda5ca670a06dc688443c2011b.exe
Score
10/10
Malware Config
Signatures
-
Matrix Ransomware 5 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"%ProgramFiles%\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\Services\verisign.bmp""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Services\verisign.bmp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\adojavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adojavas.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\adovbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adovbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado20.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado20.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado21.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado21.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado25.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado25.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado26.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado26.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado27.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado27.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msado28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msadomd28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadomd28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\ado\msadox28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadox28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\adcjavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcjavas.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\adcvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcvbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\audiodepthconverter.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\audiodepthconverter.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\audiodepthconverter.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\audiodepthconverter.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\bod_r.TTF""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\bod_r.TTF"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\bod_r.TTF" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\bod_r.TTF"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\directshowtap.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\directshowtap.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\directshowtap.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\directshowtap.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Eurosti.TTF""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Eurosti.TTF"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Eurosti.TTF" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Eurosti.TTF"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\fieldswitch.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\fieldswitch.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\fieldswitch.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\fieldswitch.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\offset.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\offset.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\offset.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\offset.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\rtstreamsink.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\rtstreamsink.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\rtstreamsink.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\rtstreamsink.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\rtstreamsource.ax""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\rtstreamsource.ax"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\rtstreamsource.ax" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\rtstreamsource.ax"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\SecretST.TTF""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\SecretST.TTF"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\SecretST.TTF" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\SecretST.TTF"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\Common.fxh""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\Common.fxh"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\Common.fxh" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\Common.fxh"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DissolveAnother.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DissolveAnother.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DissolveAnother.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DissolveAnother.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DissolveNoise.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DissolveNoise.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DissolveNoise.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DissolveNoise.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\foo\28ZgLU0Y.cmd" "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6650ce31671b194e0f941868f2f3542f
SHA1792a8fd0204ec0417f720a95a7cfd6286792d6dd
SHA256bea908f559e636b7a4a693045bb957f1f9892204fb084d7aa411986b3386899b
SHA5126eeb7a14d69b1ea6523bc7484777748f2e9f1b29be4802414a1a8806552bb1316021c977e7a3c79f8838f7a4692682ead66090d1692b2d102a91ee57a4d77b78
-
MD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
MD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
MD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
4KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
4KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-