Overview
overview
10Static
static
10foo/0044d6...f7.exe
windows7_x64
1foo/0044d6...f7.exe
windows10_x64
1foo/034e4c...a9.exe
windows7_x64
4foo/034e4c...a9.exe
windows10_x64
4foo/035fa2...72.exe
windows7_x64
10foo/035fa2...72.exe
windows10_x64
10foo/04884a...1b.exe
windows7_x64
8foo/04884a...1b.exe
windows10_x64
8foo/06ed82...59.exe
windows7_x64
7foo/06ed82...59.exe
windows10_x64
7foo/07470b...68.exe
windows7_x64
8foo/07470b...68.exe
windows10_x64
8foo/078adb...c0.exe
windows7_x64
10foo/078adb...c0.exe
windows10_x64
10foo/09e5c8...b4.exe
windows7_x64
1foo/09e5c8...b4.exe
windows10_x64
1foo/0becfe...f4.exe
windows7_x64
10foo/0becfe...f4.exe
windows10_x64
10foo/1a78d3...a3.exe
windows7_x64
5foo/1a78d3...a3.exe
windows10_x64
5foo/1ffe82...a6.exe
windows7_x64
10foo/1ffe82...a6.exe
windows10_x64
10foo/255028...e1.dll
windows7_x64
1foo/255028...e1.dll
windows10_x64
1foo/27601d...cc.exe
windows7_x64
8foo/27601d...cc.exe
windows10_x64
8foo/27f911...49.exe
windows7_x64
10foo/27f911...49.exe
windows10_x64
10foo/28408c...c5.exe
windows7_x64
10foo/28408c...c5.exe
windows10_x64
10foo/296822...e4.dll
windows7_x64
3foo/296822...e4.dll
windows10_x64
3foo/2de7b8...a4.exe
windows7_x64
10foo/2de7b8...a4.exe
windows10_x64
10foo/2e00df...8b.exe
windows7_x64
9foo/2e00df...8b.exe
windows10_x64
9foo/2e90a1...22.exe
windows7_x64
6foo/2e90a1...22.exe
windows10_x64
6foo/2f215e...b0.dll
windows7_x64
10foo/2f215e...b0.dll
windows10_x64
10foo/30bc06...3e.exe
windows7_x64
10foo/30bc06...3e.exe
windows10_x64
10foo/312e67...f3.exe
windows7_x64
4foo/312e67...f3.exe
windows10_x64
4foo/383497...1b.exe
windows7_x64
10foo/383497...1b.exe
windows10_x64
10foo/39555e...ec.exe
windows7_x64
10foo/39555e...ec.exe
windows10_x64
10foo/39e531...04.exe
windows7_x64
10foo/39e531...04.exe
windows10_x64
10foo/3aba72...cd.exe
windows7_x64
1foo/3aba72...cd.exe
windows10_x64
1foo/406c9b...fe.exe
windows7_x64
10foo/406c9b...fe.exe
windows10_x64
10foo/457cfd...ca.exe
windows7_x64
7foo/457cfd...ca.exe
windows10_x64
7foo/4761e4...60.exe
windows7_x64
8foo/4761e4...60.exe
windows10_x64
8foo/487f1b...04.exe
windows7_x64
8foo/487f1b...04.exe
windows10_x64
7foo/4a74c9...cf.exe
windows7_x64
10foo/4a74c9...cf.exe
windows10_x64
10foo/4b2d78...4b.exe
windows7_x64
8foo/4b2d78...4b.exe
windows10_x64
8foo/4c49c2...ba.exe
windows7_x64
1foo/4c49c2...ba.exe
windows10_x64
1foo/4cfe8f...77.exe
windows7_x64
9foo/4cfe8f...77.exe
windows10_x64
9foo/4ea454...13.exe
windows7_x64
8foo/4ea454...13.exe
windows10_x64
8foo/52d6c5...7e.exe
windows7_x64
7foo/52d6c5...7e.exe
windows10_x64
7foo/55fc11...e0.exe
windows7_x64
foo/55fc11...e0.exe
windows10_x64
10foo/59f0fb...06.exe
windows7_x64
1foo/59f0fb...06.exe
windows10_x64
1foo/5b1c0d...cb.exe
windows7_x64
1foo/5b1c0d...cb.exe
windows10_x64
1foo/5bc72a...ea.exe
windows7_x64
8foo/5bc72a...ea.exe
windows10_x64
8foo/5d3305...2a.exe
windows7_x64
7foo/5d3305...2a.exe
windows10_x64
7foo/5d9775...39.exe
windows7_x64
8foo/5d9775...39.exe
windows10_x64
8foo/60121e...3e.exe
windows7_x64
9foo/60121e...3e.exe
windows10_x64
9foo/62565a...fd.exe
windows7_x64
10foo/62565a...fd.exe
windows10_x64
10foo/62a3fd...64.exe
windows7_x64
8foo/62a3fd...64.exe
windows10_x64
10foo/63e9ce...d0.exe
windows7_x64
8foo/63e9ce...d0.exe
windows10_x64
8foo/6497ba...c5.exe
windows7_x64
10foo/6497ba...c5.exe
windows10_x64
10foo/698cc8...31.exe
windows7_x64
7foo/698cc8...31.exe
windows10_x64
7foo/6f2c5c...d5.exe
windows7_x64
7foo/6f2c5c...d5.exe
windows10_x64
7foo/798f5e...ba.exe
windows7_x64
10foo/798f5e...ba.exe
windows10_x64
10foo/7aec86...51.exe
windows7_x64
1foo/7aec86...51.exe
windows10_x64
1foo/84bf6e...64.exe
windows7_x64
8foo/84bf6e...64.exe
windows10_x64
8foo/907b7d...b3.exe
windows7_x64
8foo/907b7d...b3.exe
windows10_x64
8foo/928f1d...ee.exe
windows7_x64
1foo/928f1d...ee.exe
windows10_x64
1foo/9401b0...6c.exe
windows7_x64
1foo/9401b0...6c.exe
windows10_x64
1foo/97dd87...84.exe
windows7_x64
10foo/97dd87...84.exe
windows10_x64
10foo/9b8c48...a4.exe
windows7_x64
8foo/9b8c48...a4.exe
windows10_x64
8foo/9cde71...cd.exe
windows7_x64
6foo/9cde71...cd.exe
windows10_x64
6foo/9d3438...4b.exe
windows7_x64
8foo/9d3438...4b.exe
windows10_x64
1foo/9f8818...2d.exe
windows7_x64
8foo/9f8818...2d.exe
windows10_x64
3foo/a17bdc...cf.exe
windows7_x64
9foo/a17bdc...cf.exe
windows10_x64
9foo/a29811...46.exe
windows7_x64
10foo/a29811...46.exe
windows10_x64
10foo/aa3b51...52.exe
windows7_x64
10foo/aa3b51...52.exe
windows10_x64
10foo/acf0b7...c4.exe
windows7_x64
8foo/acf0b7...c4.exe
windows10_x64
8foo/aeca5c...f7.exe
windows7_x64
1foo/aeca5c...f7.exe
windows10_x64
1foo/b10714...f3.exe
windows7_x64
8foo/b10714...f3.exe
windows10_x64
8foo/b23652...9f.exe
windows7_x64
6foo/b23652...9f.exe
windows10_x64
6foo/b514b5...fc.exe
windows7_x64
1foo/b514b5...fc.exe
windows10_x64
1foo/b64196...23.exe
windows7_x64
7foo/b64196...23.exe
windows10_x64
7foo/b693df...60.exe
windows7_x64
7foo/b693df...60.exe
windows10_x64
7foo/b6e7c9...bc.exe
windows7_x64
10foo/b6e7c9...bc.exe
windows10_x64
10foo/b7d5f0...4a.exe
windows7_x64
10foo/b7d5f0...4a.exe
windows10_x64
10foo/ba2d46...29.exe
windows7_x64
1foo/ba2d46...29.exe
windows10_x64
1foo/bad78e...e5.exe
windows7_x64
9foo/bad78e...e5.exe
windows10_x64
9foo/bc6536...b9.exe
windows7_x64
10foo/bc6536...b9.exe
windows10_x64
10foo/be85e0...2c.exe
windows7_x64
1foo/be85e0...2c.exe
windows10_x64
1foo/c914b1...ee.exe
windows7_x64
3foo/c914b1...ee.exe
windows10_x64
3foo/c944ea...cc.exe
windows7_x64
8foo/c944ea...cc.exe
windows10_x64
8foo/cad363...8b.exe
windows7_x64
6foo/cad363...8b.exe
windows10_x64
6foo/cd89b6...df.exe
windows7_x64
8foo/cd89b6...df.exe
windows10_x64
8foo/d81e76...c4.exe
windows7_x64
10foo/d81e76...c4.exe
windows10_x64
10foo/d86d2c...08.exe
windows7_x64
10foo/d86d2c...08.exe
windows10_x64
10foo/d8e37d...98.exe
windows7_x64
9foo/d8e37d...98.exe
windows10_x64
9foo/dea515...e1.exe
windows7_x64
10foo/dea515...e1.exe
windows10_x64
6foo/dfcc55...b8.exe
windows7_x64
7foo/dfcc55...b8.exe
windows10_x64
7foo/e03bd4...fe.exe
windows7_x64
8foo/e03bd4...fe.exe
windows10_x64
8foo/e16ec7...2d.exe
windows7_x64
8foo/e16ec7...2d.exe
windows10_x64
8foo/e61c0e...0e.exe
windows7_x64
7foo/e61c0e...0e.exe
windows10_x64
7foo/e78fad...51.exe
windows7_x64
8foo/e78fad...51.exe
windows10_x64
8foo/e7ad45...88.exe
windows7_x64
3foo/e7ad45...88.exe
windows10_x64
3foo/e95678...8f.exe
windows7_x64
1foo/e95678...8f.exe
windows10_x64
1foo/edf723...ee.dll
windows7_x64
1foo/edf723...ee.dll
windows10_x64
1foo/f2366f...f5.exe
windows7_x64
1foo/f2366f...f5.exe
windows10_x64
1foo/f645a9...1f.exe
windows7_x64
1foo/f645a9...1f.exe
windows10_x64
1foo/f65e75...56.exe
windows7_x64
1foo/f65e75...56.exe
windows10_x64
1foo/f66028...2b.exe
windows7_x64
8foo/f66028...2b.exe
windows10_x64
8foo/f6c1c7...89.exe
windows7_x64
10foo/f6c1c7...89.exe
windows10_x64
10foo/fbab90...7c.exe
windows7_x64
7foo/fbab90...7c.exe
windows10_x64
7foo/fcdc00...b3.exe
windows7_x64
8foo/fcdc00...b3.exe
windows10_x64
8foo/fffb61...ba.exe
windows7_x64
1foo/fffb61...ba.exe
windows10_x64
1Analysis
-
max time kernel
156s -
max time network
172s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-08-2020 12:30
Static task
static1
Behavioral task
behavioral1
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win7
Behavioral task
behavioral2
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win10v200722
Behavioral task
behavioral3
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win7
Behavioral task
behavioral4
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win10
Behavioral task
behavioral5
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win7v200722
Behavioral task
behavioral6
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win10
Behavioral task
behavioral7
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win7v200722
Behavioral task
behavioral8
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win10
Behavioral task
behavioral9
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win7v200722
Behavioral task
behavioral10
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win10
Behavioral task
behavioral11
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win7
Behavioral task
behavioral12
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win10v200722
Behavioral task
behavioral13
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win7
Behavioral task
behavioral14
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win10v200722
Behavioral task
behavioral15
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win7v200722
Behavioral task
behavioral16
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win10v200722
Behavioral task
behavioral17
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win7
Behavioral task
behavioral18
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win10
Behavioral task
behavioral19
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win7v200722
Behavioral task
behavioral20
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win10
Behavioral task
behavioral21
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win7v200722
Behavioral task
behavioral22
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win10v200722
Behavioral task
behavioral23
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win7v200722
Behavioral task
behavioral24
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win10
Behavioral task
behavioral25
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win7
Behavioral task
behavioral26
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win10v200722
Behavioral task
behavioral27
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win7
Behavioral task
behavioral28
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win10v200722
Behavioral task
behavioral29
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win7
Behavioral task
behavioral30
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win10v200722
Behavioral task
behavioral31
Sample
foo/29682275a385f42634ee312db7f666e4.dll
Resource
win7
Behavioral task
behavioral32
Sample
foo/29682275a385f42634ee312db7f666e4.dll
Resource
win10
Behavioral task
behavioral33
Sample
foo/2de7b886ed3bf5455694d76ac69a96a4.exe
Resource
win7v200722
Behavioral task
behavioral34
Sample
foo/2de7b886ed3bf5455694d76ac69a96a4.exe
Resource
win10v200722
Behavioral task
behavioral35
Sample
foo/2e00df497f82c0bf215548969fefc18b.exe
Resource
win7v200722
Behavioral task
behavioral36
Sample
foo/2e00df497f82c0bf215548969fefc18b.exe
Resource
win10v200722
Behavioral task
behavioral37
Sample
foo/2e90a15707ad3eb4cd06bd8a05463922.exe
Resource
win7
Behavioral task
behavioral38
Sample
foo/2e90a15707ad3eb4cd06bd8a05463922.exe
Resource
win10
Behavioral task
behavioral39
Sample
foo/2f215e008c6a7d8886c578e442b8f1b0.dll
Resource
win7
Behavioral task
behavioral40
Sample
foo/2f215e008c6a7d8886c578e442b8f1b0.dll
Resource
win10
Behavioral task
behavioral41
Sample
foo/30bc06d0add076dd6500fcdfbc12643e.exe
Resource
win7
Behavioral task
behavioral42
Sample
foo/30bc06d0add076dd6500fcdfbc12643e.exe
Resource
win10
Behavioral task
behavioral43
Sample
foo/312e67dc35992949937d1bad6ba529f3.exe
Resource
win7
Behavioral task
behavioral44
Sample
foo/312e67dc35992949937d1bad6ba529f3.exe
Resource
win10v200722
Behavioral task
behavioral45
Sample
foo/383497fda5ca670a06dc688443c2011b.exe
Resource
win7
Behavioral task
behavioral46
Sample
foo/383497fda5ca670a06dc688443c2011b.exe
Resource
win10v200722
Behavioral task
behavioral47
Sample
foo/39555eb0403a69906729713ad20888ec.exe
Resource
win7
Behavioral task
behavioral48
Sample
foo/39555eb0403a69906729713ad20888ec.exe
Resource
win10v200722
Behavioral task
behavioral49
Sample
foo/39e5310f67f0b1bf98604a2e0edb9204.exe
Resource
win7v200722
Behavioral task
behavioral50
Sample
foo/39e5310f67f0b1bf98604a2e0edb9204.exe
Resource
win10v200722
Behavioral task
behavioral51
Sample
foo/3aba72d1f87f4372162972b6a45ed8cd.exe
Resource
win7v200722
Behavioral task
behavioral52
Sample
foo/3aba72d1f87f4372162972b6a45ed8cd.exe
Resource
win10v200722
Behavioral task
behavioral53
Sample
foo/406c9b9529109f835fe7292e6cf3fefe.exe
Resource
win7v200722
Behavioral task
behavioral54
Sample
foo/406c9b9529109f835fe7292e6cf3fefe.exe
Resource
win10v200722
Behavioral task
behavioral55
Sample
foo/457cfd3e7a53e7500f8206b3ea300aca.exe
Resource
win7v200722
Behavioral task
behavioral56
Sample
foo/457cfd3e7a53e7500f8206b3ea300aca.exe
Resource
win10
Behavioral task
behavioral57
Sample
foo/4761e4b165f62d326b9032d96329e460.exe
Resource
win7v200722
Behavioral task
behavioral58
Sample
foo/4761e4b165f62d326b9032d96329e460.exe
Resource
win10
Behavioral task
behavioral59
Sample
foo/487f1b1f30212eaa9104c084a667f104.exe
Resource
win7v200722
Behavioral task
behavioral60
Sample
foo/487f1b1f30212eaa9104c084a667f104.exe
Resource
win10
Behavioral task
behavioral61
Sample
foo/4a74c9f378007412ec2c8b2eea6da4cf.exe
Resource
win7
Behavioral task
behavioral62
Sample
foo/4a74c9f378007412ec2c8b2eea6da4cf.exe
Resource
win10v200722
Behavioral task
behavioral63
Sample
foo/4b2d7854b47943b118e24c6ec79b974b.exe
Resource
win7
Behavioral task
behavioral64
Sample
foo/4b2d7854b47943b118e24c6ec79b974b.exe
Resource
win10
Behavioral task
behavioral65
Sample
foo/4c49c2496ae538bcec9e1510f3eb8eba.exe
Resource
win7v200722
Behavioral task
behavioral66
Sample
foo/4c49c2496ae538bcec9e1510f3eb8eba.exe
Resource
win10v200722
Behavioral task
behavioral67
Sample
foo/4cfe8f3aa1592035b9a2cdb2c4f54c77.exe
Resource
win7v200722
Behavioral task
behavioral68
Sample
foo/4cfe8f3aa1592035b9a2cdb2c4f54c77.exe
Resource
win10
Behavioral task
behavioral69
Sample
foo/4ea45460c3e7c3d8486d3f7bec90c613.exe
Resource
win7
Behavioral task
behavioral70
Sample
foo/4ea45460c3e7c3d8486d3f7bec90c613.exe
Resource
win10v200722
Behavioral task
behavioral71
Sample
foo/52d6c59fcfe73048a240c7fdd1f04d7e.exe
Resource
win7
Behavioral task
behavioral72
Sample
foo/52d6c59fcfe73048a240c7fdd1f04d7e.exe
Resource
win10v200722
Behavioral task
behavioral73
Sample
foo/55fc11ec67a00177d047d5abc84231e0.exe
Resource
win7v200722
Behavioral task
behavioral74
Sample
foo/55fc11ec67a00177d047d5abc84231e0.exe
Resource
win10
Behavioral task
behavioral75
Sample
foo/59f0fbc29bace019804b8a181ce75a06.exe
Resource
win7v200722
Behavioral task
behavioral76
Sample
foo/59f0fbc29bace019804b8a181ce75a06.exe
Resource
win10
Behavioral task
behavioral77
Sample
foo/5b1c0df2be80006ec3af6a5eeea17ecb.exe
Resource
win7v200722
Behavioral task
behavioral78
Sample
foo/5b1c0df2be80006ec3af6a5eeea17ecb.exe
Resource
win10
Behavioral task
behavioral79
Sample
foo/5bc72a1ae433663758319d97917b77ea.exe
Resource
win7v200722
Behavioral task
behavioral80
Sample
foo/5bc72a1ae433663758319d97917b77ea.exe
Resource
win10v200722
Behavioral task
behavioral81
Sample
foo/5d33050f0514054c49f2bc2ff9abee2a.exe
Resource
win7
Behavioral task
behavioral82
Sample
foo/5d33050f0514054c49f2bc2ff9abee2a.exe
Resource
win10
Behavioral task
behavioral83
Sample
foo/5d9775622b5e7123d5796d4de5dc2839.exe
Resource
win7
Behavioral task
behavioral84
Sample
foo/5d9775622b5e7123d5796d4de5dc2839.exe
Resource
win10
Behavioral task
behavioral85
Sample
foo/60121ea2ab380455f7e143cd9438443e.exe
Resource
win7
Behavioral task
behavioral86
Sample
foo/60121ea2ab380455f7e143cd9438443e.exe
Resource
win10
Behavioral task
behavioral87
Sample
foo/62565a39c4a264e48e0678edad5d60fd.exe
Resource
win7
Behavioral task
behavioral88
Sample
foo/62565a39c4a264e48e0678edad5d60fd.exe
Resource
win10v200722
Behavioral task
behavioral89
Sample
foo/62a3fd9b4932e59a7192813c22617764.exe
Resource
win7v200722
Behavioral task
behavioral90
Sample
foo/62a3fd9b4932e59a7192813c22617764.exe
Resource
win10
Behavioral task
behavioral91
Sample
foo/63e9ce22dbf66934fd75c77bc84954d0.exe
Resource
win7
Behavioral task
behavioral92
Sample
foo/63e9ce22dbf66934fd75c77bc84954d0.exe
Resource
win10
Behavioral task
behavioral93
Sample
foo/6497ba06c339ec8ca438ddf0dd2f8fc5.exe
Resource
win7v200722
Behavioral task
behavioral94
Sample
foo/6497ba06c339ec8ca438ddf0dd2f8fc5.exe
Resource
win10v200722
Behavioral task
behavioral95
Sample
foo/698cc868cdae13a5cc744020ec00e331.exe
Resource
win7v200722
Behavioral task
behavioral96
Sample
foo/698cc868cdae13a5cc744020ec00e331.exe
Resource
win10v200722
Behavioral task
behavioral97
Sample
foo/6f2c5c31fefa00afa2af1adcbdd93ad5.exe
Resource
win7v200722
Behavioral task
behavioral98
Sample
foo/6f2c5c31fefa00afa2af1adcbdd93ad5.exe
Resource
win10v200722
Behavioral task
behavioral99
Sample
foo/798f5e61531f527821a490a15ef957ba.exe
Resource
win7v200722
Behavioral task
behavioral100
Sample
foo/798f5e61531f527821a490a15ef957ba.exe
Resource
win10v200722
Behavioral task
behavioral101
Sample
foo/7aec86c6c4cc35139b7874a0117e4451.exe
Resource
win7v200722
Behavioral task
behavioral102
Sample
foo/7aec86c6c4cc35139b7874a0117e4451.exe
Resource
win10v200722
Behavioral task
behavioral103
Sample
foo/84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
Resource
win7v200722
Behavioral task
behavioral104
Sample
foo/84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
Resource
win10v200722
Behavioral task
behavioral105
Sample
foo/907b7d9a23ed7821abb700fcbe1c9bb3.exe
Resource
win7v200722
Behavioral task
behavioral106
Sample
foo/907b7d9a23ed7821abb700fcbe1c9bb3.exe
Resource
win10v200722
Behavioral task
behavioral107
Sample
foo/928f1db0c63d122f0183686a3bdfccee.exe
Resource
win7v200722
Behavioral task
behavioral108
Sample
foo/928f1db0c63d122f0183686a3bdfccee.exe
Resource
win10
Behavioral task
behavioral109
Sample
foo/9401b0788dc22eeb1dace02d23a9596c.exe
Resource
win7
Behavioral task
behavioral110
Sample
foo/9401b0788dc22eeb1dace02d23a9596c.exe
Resource
win10v200722
Behavioral task
behavioral111
Sample
foo/97dd8726304f889ef12ef1beb510be84.exe
Resource
win7
Behavioral task
behavioral112
Sample
foo/97dd8726304f889ef12ef1beb510be84.exe
Resource
win10v200722
Behavioral task
behavioral113
Sample
foo/9b8c48e6186718b7b290ceed9369a1a4.exe
Resource
win7v200722
Behavioral task
behavioral114
Sample
foo/9b8c48e6186718b7b290ceed9369a1a4.exe
Resource
win10
Behavioral task
behavioral115
Sample
foo/9cde71abfd2a6aeb83cdd233cbc04fcd.exe
Resource
win7v200722
Behavioral task
behavioral116
Sample
foo/9cde71abfd2a6aeb83cdd233cbc04fcd.exe
Resource
win10
Behavioral task
behavioral117
Sample
foo/9d3438ba1dbdbcc2a65451893e38004b.exe
Resource
win7
Behavioral task
behavioral118
Sample
foo/9d3438ba1dbdbcc2a65451893e38004b.exe
Resource
win10
Behavioral task
behavioral119
Sample
foo/9f88187d774cc9eaf89dc65479c4302d.exe
Resource
win7
Behavioral task
behavioral120
Sample
foo/9f88187d774cc9eaf89dc65479c4302d.exe
Resource
win10
Behavioral task
behavioral121
Sample
foo/a17bdcde184026e23ae6dc8723f73fcf.exe
Resource
win7v200722
Behavioral task
behavioral122
Sample
foo/a17bdcde184026e23ae6dc8723f73fcf.exe
Resource
win10v200722
Behavioral task
behavioral123
Sample
foo/a2981192a30538e97b55f363abbce946.exe
Resource
win7
Behavioral task
behavioral124
Sample
foo/a2981192a30538e97b55f363abbce946.exe
Resource
win10
Behavioral task
behavioral125
Sample
foo/aa3b51bd50bcc98f763cffcf7f907152.exe
Resource
win7
Behavioral task
behavioral126
Sample
foo/aa3b51bd50bcc98f763cffcf7f907152.exe
Resource
win10
Behavioral task
behavioral127
Sample
foo/acf0b7f4fe980501192187bb9b8e20c4.exe
Resource
win7v200722
Behavioral task
behavioral128
Sample
foo/acf0b7f4fe980501192187bb9b8e20c4.exe
Resource
win10
Behavioral task
behavioral129
Sample
foo/aeca5c301d02253e8ffcc240c08f61f7.exe
Resource
win7v200722
Behavioral task
behavioral130
Sample
foo/aeca5c301d02253e8ffcc240c08f61f7.exe
Resource
win10
Behavioral task
behavioral131
Sample
foo/b1071426aa88f31339f1b369cf13cef3.exe
Resource
win7v200722
Behavioral task
behavioral132
Sample
foo/b1071426aa88f31339f1b369cf13cef3.exe
Resource
win10v200722
Behavioral task
behavioral133
Sample
foo/b2365260985173cc758575cd8059459f.exe
Resource
win7v200722
Behavioral task
behavioral134
Sample
foo/b2365260985173cc758575cd8059459f.exe
Resource
win10
Behavioral task
behavioral135
Sample
foo/b514b59324818c52140b431aeac96bfc.exe
Resource
win7v200722
Behavioral task
behavioral136
Sample
foo/b514b59324818c52140b431aeac96bfc.exe
Resource
win10
Behavioral task
behavioral137
Sample
foo/b641961018d09dfbd7fa9c15f09a7723.exe
Resource
win7
Behavioral task
behavioral138
Sample
foo/b641961018d09dfbd7fa9c15f09a7723.exe
Resource
win10
Behavioral task
behavioral139
Sample
foo/b693dfe99d2915616044eea2cfe18360.exe
Resource
win7
Behavioral task
behavioral140
Sample
foo/b693dfe99d2915616044eea2cfe18360.exe
Resource
win10
Behavioral task
behavioral141
Sample
foo/b6e7c9793cf40153bf8865195e06ecbc.exe
Resource
win7v200722
Behavioral task
behavioral142
Sample
foo/b6e7c9793cf40153bf8865195e06ecbc.exe
Resource
win10v200722
Behavioral task
behavioral143
Sample
foo/b7d5f0b9bf2e6e13c5b3ca1c2a0a8b4a.exe
Resource
win7
Behavioral task
behavioral144
Sample
foo/b7d5f0b9bf2e6e13c5b3ca1c2a0a8b4a.exe
Resource
win10v200722
Behavioral task
behavioral145
Sample
foo/ba2d460199eb2d9e9d6d0559bb455529.exe
Resource
win7
Behavioral task
behavioral146
Sample
foo/ba2d460199eb2d9e9d6d0559bb455529.exe
Resource
win10v200722
Behavioral task
behavioral147
Sample
foo/bad78e11371381ce9e1d703aac2821e5.exe
Resource
win7
Behavioral task
behavioral148
Sample
foo/bad78e11371381ce9e1d703aac2821e5.exe
Resource
win10v200722
Behavioral task
behavioral149
Sample
foo/bc6536b86b04cf5b3bf7cd353d615ab9.exe
Resource
win7v200722
Behavioral task
behavioral150
Sample
foo/bc6536b86b04cf5b3bf7cd353d615ab9.exe
Resource
win10v200722
Behavioral task
behavioral151
Sample
foo/be85e0b2608a55942aa101c66ce6c32c.exe
Resource
win7v200722
Behavioral task
behavioral152
Sample
foo/be85e0b2608a55942aa101c66ce6c32c.exe
Resource
win10v200722
Behavioral task
behavioral153
Sample
foo/c914b169d1388c5e78421045d05946ee.exe
Resource
win7v200722
Behavioral task
behavioral154
Sample
foo/c914b169d1388c5e78421045d05946ee.exe
Resource
win10v200722
Behavioral task
behavioral155
Sample
foo/c944eadb6e032fd9e7a0988464a6f1cc.exe
Resource
win7v200722
Behavioral task
behavioral156
Sample
foo/c944eadb6e032fd9e7a0988464a6f1cc.exe
Resource
win10v200722
Behavioral task
behavioral157
Sample
foo/cad3634df5d5058551bed38237ab8e8b.exe
Resource
win7
Behavioral task
behavioral158
Sample
foo/cad3634df5d5058551bed38237ab8e8b.exe
Resource
win10v200722
Behavioral task
behavioral159
Sample
foo/cd89b6c808c296cde0bc77ee630dc7df.exe
Resource
win7v200722
Behavioral task
behavioral160
Sample
foo/cd89b6c808c296cde0bc77ee630dc7df.exe
Resource
win10v200722
Behavioral task
behavioral161
Sample
foo/d81e76123ccb64b73eeac2f31a7434c4.exe
Resource
win7v200722
Behavioral task
behavioral162
Sample
foo/d81e76123ccb64b73eeac2f31a7434c4.exe
Resource
win10
Behavioral task
behavioral163
Sample
foo/d86d2cb12111422ad0b401afa523e308.exe
Resource
win7v200722
Behavioral task
behavioral164
Sample
foo/d86d2cb12111422ad0b401afa523e308.exe
Resource
win10v200722
Behavioral task
behavioral165
Sample
foo/d8e37dd7ca017370a0b54147a27a7498.exe
Resource
win7v200722
Behavioral task
behavioral166
Sample
foo/d8e37dd7ca017370a0b54147a27a7498.exe
Resource
win10
Behavioral task
behavioral167
Sample
foo/dea515c25081073ec2cee293b2991ee1.exe
Resource
win7v200722
Behavioral task
behavioral168
Sample
foo/dea515c25081073ec2cee293b2991ee1.exe
Resource
win10v200722
Behavioral task
behavioral169
Sample
foo/dfcc555a02bccc9c438b08555b5c2ab8.exe
Resource
win7
Behavioral task
behavioral170
Sample
foo/dfcc555a02bccc9c438b08555b5c2ab8.exe
Resource
win10v200722
Behavioral task
behavioral171
Sample
foo/e03bd458de4a107688236bdc4ddc3afe.exe
Resource
win7
Behavioral task
behavioral172
Sample
foo/e03bd458de4a107688236bdc4ddc3afe.exe
Resource
win10v200722
Behavioral task
behavioral173
Sample
foo/e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
Resource
win7
Behavioral task
behavioral174
Sample
foo/e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
Resource
win10
Behavioral task
behavioral175
Sample
foo/e61c0e180c2616fa81e6c4d581a9520e.exe
Resource
win7v200722
Behavioral task
behavioral176
Sample
foo/e61c0e180c2616fa81e6c4d581a9520e.exe
Resource
win10v200722
Behavioral task
behavioral177
Sample
foo/e78fad8a5d0ea89127ed36ed20bc9351.exe
Resource
win7
Behavioral task
behavioral178
Sample
foo/e78fad8a5d0ea89127ed36ed20bc9351.exe
Resource
win10
Behavioral task
behavioral179
Sample
foo/e7ad45164be5c3c7f9936e9b5fb28788.exe
Resource
win7
Behavioral task
behavioral180
Sample
foo/e7ad45164be5c3c7f9936e9b5fb28788.exe
Resource
win10
Behavioral task
behavioral181
Sample
foo/e95678212c7218c6e7944fca1631c88f.exe
Resource
win7
Behavioral task
behavioral182
Sample
foo/e95678212c7218c6e7944fca1631c88f.exe
Resource
win10v200722
Behavioral task
behavioral183
Sample
foo/edf723c8e404cd67041e7dfbbb1a6eee.dll
Resource
win7
Behavioral task
behavioral184
Sample
foo/edf723c8e404cd67041e7dfbbb1a6eee.dll
Resource
win10
Behavioral task
behavioral185
Sample
foo/f2366f48d3534bc8af573f2696dce4f5.exe
Resource
win7v200722
Behavioral task
behavioral186
Sample
foo/f2366f48d3534bc8af573f2696dce4f5.exe
Resource
win10
Behavioral task
behavioral187
Sample
foo/f645a94491240317caccd6f8508fba1f.exe
Resource
win7v200722
Behavioral task
behavioral188
Sample
foo/f645a94491240317caccd6f8508fba1f.exe
Resource
win10
Behavioral task
behavioral189
Sample
foo/f65e75d9675a50f9b4807e79dcc48d56.exe
Resource
win7v200722
Behavioral task
behavioral190
Sample
foo/f65e75d9675a50f9b4807e79dcc48d56.exe
Resource
win10
Behavioral task
behavioral191
Sample
foo/f660284cb3574213a512e3f03ca9012b.exe
Resource
win7
Behavioral task
behavioral192
Sample
foo/f660284cb3574213a512e3f03ca9012b.exe
Resource
win10
Behavioral task
behavioral193
Sample
foo/f6c1c72f3e45d2f3499b6bd6661b3289.exe
Resource
win7
Behavioral task
behavioral194
Sample
foo/f6c1c72f3e45d2f3499b6bd6661b3289.exe
Resource
win10
Behavioral task
behavioral195
Sample
foo/fbab903080d6a4e65a1a2f6bc4d97b7c.exe
Resource
win7
Behavioral task
behavioral196
Sample
foo/fbab903080d6a4e65a1a2f6bc4d97b7c.exe
Resource
win10
Behavioral task
behavioral197
Sample
foo/fcdc003a1529fe3660b160fd012173b3.exe
Resource
win7v200722
Behavioral task
behavioral198
Sample
foo/fcdc003a1529fe3660b160fd012173b3.exe
Resource
win10
Behavioral task
behavioral199
Sample
foo/fffb61eaaac6e8a40bfaa7a4acb6b9ba.exe
Resource
win7
Behavioral task
behavioral200
Sample
foo/fffb61eaaac6e8a40bfaa7a4acb6b9ba.exe
Resource
win10v200722
General
-
Target
foo/383497fda5ca670a06dc688443c2011b.exe
Malware Config
Signatures
-
Matrix Ransomware 5 IoCs
Targeted ransomware with information collection and encryption functionality.
Processes:
description flow ioc HTTP URL 8 http://murikos.in/add.php?apikey=BKTqstat&compuser=LZUKLIOU|Admin&sid=rQfjizDAjnclTCVX&phase=START HTTP URL 9 http://murikos.in/add.php?apikey=BKTqstat&compuser=LZUKLIOU|Admin&sid=7dVNJwscVqm5mfIA&phase=START HTTP URL 93 http://murikos.in/add.php?apikey=BKTqstat&compuser=LZUKLIOU|Admin&sid=7dVNJwscVqm5mfIA&phase=L_3FEADF807A14DA81_8996_2GB HTTP URL 143 http://murikos.in/add.php?apikey=BKTqstat&compuser=LZUKLIOU|Admin&sid=7dVNJwscVqm5mfIA&phase=L_DONE_10 HTTP URL 144 http://murikos.in/add.php?apikey=BKTqstat&compuser=LZUKLIOU|Admin&sid=7dVNJwscVqm5mfIA&phase=L_DONE_100 -
Executes dropped EXE 1 IoCs
Processes:
n383497fda5ca670a06dc688443c2011b.exepid process 2680 n383497fda5ca670a06dc688443c2011b.exe -
Modifies file permissions 1 TTPs 64 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exepid process 6720 takeown.exe 6828 takeown.exe 6240 takeown.exe 6856 takeown.exe 6928 takeown.exe 4200 takeown.exe 6128 takeown.exe 6504 takeown.exe 6580 takeown.exe 760 takeown.exe 5804 takeown.exe 6396 takeown.exe 7084 takeown.exe 6852 takeown.exe 3200 takeown.exe 420 takeown.exe 6052 takeown.exe 1100 takeown.exe 5552 takeown.exe 992 takeown.exe 4748 takeown.exe 6080 takeown.exe 2260 takeown.exe 5944 takeown.exe 6360 takeown.exe 4868 takeown.exe 4504 takeown.exe 5444 takeown.exe 4208 takeown.exe 5020 takeown.exe 6008 takeown.exe 1952 takeown.exe 4752 takeown.exe 6560 takeown.exe 5056 takeown.exe 5072 takeown.exe 6004 takeown.exe 5900 takeown.exe 6196 takeown.exe 2140 takeown.exe 4324 takeown.exe 4896 takeown.exe 6940 takeown.exe 6332 takeown.exe 5972 takeown.exe 5772 takeown.exe 7040 takeown.exe 6216 takeown.exe 4460 takeown.exe 4468 takeown.exe 4292 takeown.exe 6436 takeown.exe 4548 takeown.exe 2712 takeown.exe 5544 takeown.exe 6624 takeown.exe 6836 takeown.exe 6048 takeown.exe 5508 takeown.exe 376 takeown.exe 4148 takeown.exe 5100 takeown.exe 5816 takeown.exe 6400 takeown.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\README = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\#What_Wrong_With_Files#.rtf\"" reg.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
383497fda5ca670a06dc688443c2011b.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\desktop.ini 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini 383497fda5ca670a06dc688443c2011b.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
383497fda5ca670a06dc688443c2011b.exedescription ioc process File opened (read-only) \??\W: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\T: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\L: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\J: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\F: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\E: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\S: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\R: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\P: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\N: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\H: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\Z: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\Y: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\V: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\Q: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\O: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\M: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\G: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\X: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\U: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\K: 383497fda5ca670a06dc688443c2011b.exe File opened (read-only) \??\I: 383497fda5ca670a06dc688443c2011b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
383497fda5ca670a06dc688443c2011b.exeattrib.exeattrib.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml attrib.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 383497fda5ca670a06dc688443c2011b.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\VERSION.txt 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\psfontj2d.properties 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_CN.properties 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 383497fda5ca670a06dc688443c2011b.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\javafx-src.zip 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#What_Wrong_With_Files#.rtf 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui attrib.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg attrib.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar 383497fda5ca670a06dc688443c2011b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\net.properties 383497fda5ca670a06dc688443c2011b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exedescription pid process Token: SeTakeOwnershipPrivilege 1156 takeown.exe Token: SeTakeOwnershipPrivilege 1952 takeown.exe Token: SeTakeOwnershipPrivilege 2140 takeown.exe Token: SeTakeOwnershipPrivilege 1072 takeown.exe Token: SeTakeOwnershipPrivilege 2388 takeown.exe Token: SeTakeOwnershipPrivilege 4108 takeown.exe Token: SeTakeOwnershipPrivilege 4216 takeown.exe Token: SeTakeOwnershipPrivilege 4324 takeown.exe Token: SeTakeOwnershipPrivilege 4432 takeown.exe Token: SeTakeOwnershipPrivilege 4544 takeown.exe Token: SeTakeOwnershipPrivilege 4652 takeown.exe Token: SeTakeOwnershipPrivilege 4760 takeown.exe Token: SeTakeOwnershipPrivilege 4868 takeown.exe Token: SeTakeOwnershipPrivilege 4976 takeown.exe Token: SeTakeOwnershipPrivilege 5084 takeown.exe Token: SeTakeOwnershipPrivilege 4144 takeown.exe Token: SeTakeOwnershipPrivilege 4288 takeown.exe Token: SeTakeOwnershipPrivilege 4424 takeown.exe Token: SeTakeOwnershipPrivilege 4548 takeown.exe Token: SeTakeOwnershipPrivilege 4604 takeown.exe Token: SeTakeOwnershipPrivilege 4708 takeown.exe Token: SeTakeOwnershipPrivilege 4896 takeown.exe Token: SeTakeOwnershipPrivilege 5056 takeown.exe Token: SeTakeOwnershipPrivilege 992 takeown.exe Token: SeTakeOwnershipPrivilege 4312 takeown.exe Token: SeTakeOwnershipPrivilege 4240 takeown.exe Token: SeTakeOwnershipPrivilege 4460 takeown.exe Token: SeTakeOwnershipPrivilege 4728 takeown.exe Token: SeTakeOwnershipPrivilege 4812 takeown.exe Token: SeTakeOwnershipPrivilege 5072 takeown.exe Token: SeTakeOwnershipPrivilege 5032 takeown.exe Token: SeTakeOwnershipPrivilege 4208 takeown.exe Token: SeTakeOwnershipPrivilege 4172 takeown.exe Token: SeTakeOwnershipPrivilege 4456 takeown.exe Token: SeTakeOwnershipPrivilege 4820 takeown.exe Token: SeTakeOwnershipPrivilege 5060 takeown.exe Token: SeTakeOwnershipPrivilege 4960 takeown.exe Token: SeTakeOwnershipPrivilege 4148 takeown.exe Token: SeTakeOwnershipPrivilege 4468 takeown.exe Token: SeTakeOwnershipPrivilege 4608 takeown.exe Token: SeTakeOwnershipPrivilege 5048 takeown.exe Token: SeTakeOwnershipPrivilege 2392 takeown.exe Token: SeTakeOwnershipPrivilege 4160 takeown.exe Token: SeTakeOwnershipPrivilege 4408 takeown.exe Token: SeTakeOwnershipPrivilege 4664 takeown.exe Token: SeTakeOwnershipPrivilege 1492 takeown.exe Token: SeTakeOwnershipPrivilege 4140 takeown.exe Token: SeTakeOwnershipPrivilege 4400 takeown.exe Token: SeTakeOwnershipPrivilege 4684 takeown.exe Token: SeTakeOwnershipPrivilege 5004 takeown.exe Token: SeTakeOwnershipPrivilege 5100 takeown.exe Token: SeTakeOwnershipPrivilege 4644 takeown.exe Token: SeTakeOwnershipPrivilege 4656 takeown.exe Token: SeTakeOwnershipPrivilege 760 takeown.exe Token: SeTakeOwnershipPrivilege 4200 takeown.exe Token: SeTakeOwnershipPrivilege 4440 takeown.exe Token: SeTakeOwnershipPrivilege 4152 takeown.exe Token: SeTakeOwnershipPrivilege 4988 takeown.exe Token: SeTakeOwnershipPrivilege 4724 takeown.exe Token: SeTakeOwnershipPrivilege 2960 takeown.exe Token: SeTakeOwnershipPrivilege 5020 takeown.exe Token: SeTakeOwnershipPrivilege 4300 takeown.exe Token: SeTakeOwnershipPrivilege 4120 takeown.exe Token: SeTakeOwnershipPrivilege 4688 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
383497fda5ca670a06dc688443c2011b.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 852 wrote to memory of 2680 852 383497fda5ca670a06dc688443c2011b.exe n383497fda5ca670a06dc688443c2011b.exe PID 852 wrote to memory of 2680 852 383497fda5ca670a06dc688443c2011b.exe n383497fda5ca670a06dc688443c2011b.exe PID 852 wrote to memory of 2680 852 383497fda5ca670a06dc688443c2011b.exe n383497fda5ca670a06dc688443c2011b.exe PID 852 wrote to memory of 2364 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 2364 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 2364 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 2364 wrote to memory of 608 2364 cmd.exe reg.exe PID 2364 wrote to memory of 608 2364 cmd.exe reg.exe PID 2364 wrote to memory of 608 2364 cmd.exe reg.exe PID 852 wrote to memory of 3644 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 3644 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 3644 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 3644 wrote to memory of 2008 3644 cmd.exe attrib.exe PID 3644 wrote to memory of 2008 3644 cmd.exe attrib.exe PID 3644 wrote to memory of 2008 3644 cmd.exe attrib.exe PID 3644 wrote to memory of 1496 3644 cmd.exe cacls.exe PID 3644 wrote to memory of 1496 3644 cmd.exe cacls.exe PID 3644 wrote to memory of 1496 3644 cmd.exe cacls.exe PID 3644 wrote to memory of 2908 3644 cmd.exe takeown.exe PID 3644 wrote to memory of 2908 3644 cmd.exe takeown.exe PID 3644 wrote to memory of 2908 3644 cmd.exe takeown.exe PID 852 wrote to memory of 360 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 360 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 360 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 360 wrote to memory of 2120 360 cmd.exe attrib.exe PID 360 wrote to memory of 2120 360 cmd.exe attrib.exe PID 360 wrote to memory of 2120 360 cmd.exe attrib.exe PID 360 wrote to memory of 3824 360 cmd.exe cacls.exe PID 360 wrote to memory of 3824 360 cmd.exe cacls.exe PID 360 wrote to memory of 3824 360 cmd.exe cacls.exe PID 360 wrote to memory of 1156 360 cmd.exe takeown.exe PID 360 wrote to memory of 1156 360 cmd.exe takeown.exe PID 360 wrote to memory of 1156 360 cmd.exe takeown.exe PID 852 wrote to memory of 1916 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 1916 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 1916 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 1916 wrote to memory of 684 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 684 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 684 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 2688 1916 cmd.exe cacls.exe PID 1916 wrote to memory of 2688 1916 cmd.exe cacls.exe PID 1916 wrote to memory of 2688 1916 cmd.exe cacls.exe PID 1916 wrote to memory of 3592 1916 cmd.exe takeown.exe PID 1916 wrote to memory of 3592 1916 cmd.exe takeown.exe PID 1916 wrote to memory of 3592 1916 cmd.exe takeown.exe PID 852 wrote to memory of 1988 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 1988 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 1988 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 1988 wrote to memory of 3648 1988 cmd.exe attrib.exe PID 1988 wrote to memory of 3648 1988 cmd.exe attrib.exe PID 1988 wrote to memory of 3648 1988 cmd.exe attrib.exe PID 1988 wrote to memory of 1956 1988 cmd.exe cacls.exe PID 1988 wrote to memory of 1956 1988 cmd.exe cacls.exe PID 1988 wrote to memory of 1956 1988 cmd.exe cacls.exe PID 1988 wrote to memory of 2716 1988 cmd.exe takeown.exe PID 1988 wrote to memory of 2716 1988 cmd.exe takeown.exe PID 1988 wrote to memory of 2716 1988 cmd.exe takeown.exe PID 852 wrote to memory of 2352 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 2352 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 852 wrote to memory of 2352 852 383497fda5ca670a06dc688443c2011b.exe cmd.exe PID 2352 wrote to memory of 1136 2352 cmd.exe attrib.exe PID 2352 wrote to memory of 1136 2352 cmd.exe attrib.exe PID 2352 wrote to memory of 1136 2352 cmd.exe attrib.exe PID 2352 wrote to memory of 988 2352 cmd.exe cacls.exe -
Views/modifies file attributes 1 TTPs 64 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 6204 attrib.exe 4580 attrib.exe 4576 attrib.exe 5248 attrib.exe 5956 attrib.exe 5788 attrib.exe 5912 attrib.exe 6356 attrib.exe 6696 attrib.exe 7224 attrib.exe 684 attrib.exe 4720 attrib.exe 4936 attrib.exe 4184 attrib.exe 5624 attrib.exe 5856 attrib.exe 4660 attrib.exe 2220 attrib.exe 4692 attrib.exe 5592 attrib.exe 5836 attrib.exe 4340 attrib.exe 2708 attrib.exe 6896 attrib.exe 6292 attrib.exe 6748 attrib.exe 2420 attrib.exe 4912 attrib.exe 4416 attrib.exe 5352 attrib.exe 6824 attrib.exe 4248 attrib.exe 4880 attrib.exe 4124 attrib.exe 4268 attrib.exe 4852 attrib.exe 6140 attrib.exe 7004 attrib.exe 4828 attrib.exe 4540 attrib.exe 4968 attrib.exe 5852 attrib.exe 5960 attrib.exe 7064 attrib.exe 5044 attrib.exe 4844 attrib.exe 4116 attrib.exe 5868 attrib.exe 6096 attrib.exe 5296 attrib.exe 6320 attrib.exe 6572 attrib.exe 2760 attrib.exe 4860 attrib.exe 4256 attrib.exe 4744 attrib.exe 5716 attrib.exe 6016 attrib.exe 5568 attrib.exe 5684 attrib.exe 4224 attrib.exe 4908 attrib.exe 5160 attrib.exe 6364 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe" -n2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"%ProgramFiles%\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Content.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Content.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\Services\verisign.bmp""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Services\verisign.bmp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adojavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adojavas.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adovbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adovbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado20.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado20.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado21.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado21.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado25.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado25.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado26.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado26.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado27.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado27.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado60.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado60.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadomd28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadomd28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msador28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msador28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadox28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadox28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcjavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcjavas.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcvbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmdMD5
6650ce31671b194e0f941868f2f3542f
SHA1792a8fd0204ec0417f720a95a7cfd6286792d6dd
SHA256bea908f559e636b7a4a693045bb957f1f9892204fb084d7aa411986b3386899b
SHA5126eeb7a14d69b1ea6523bc7484777748f2e9f1b29be4802414a1a8806552bb1316021c977e7a3c79f8838f7a4692682ead66090d1692b2d102a91ee57a4d77b78
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exeMD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exeMD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.dbMD5
3d37ed82ee29e84e6bc8bc612c0ea952
SHA11df756665da6af091496f81b45ad7aa81eb5f6bf
SHA256456d7e0ec2dcb1491f33b71486fdabcc0bab609d05a183a22236cf35ed860ab2
SHA512189ffe611ca1721702499957c220ffae85facefcf37dd61dea233dede658cf4f966a2afff076a49f5c873248886bc13ebe0f8d35630f91b868980135bb5532e9
-
C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.dbMD5
b019b3af6e7223cffa1025666ba47664
SHA1c8175b279395fdfd8be5b7fc0435994ca76dd7e4
SHA256182df96f75cba03f299d987a2403e256081c9546c33a8d4fb2f389617ee3b435
SHA512e40d37a597a76926dae16cdd40d6a3cc077f1b6d7ceb003c55f202b792ea950c7cfed9b677e116336a12870ce11dc2a423a3b2a62c5f7787aa56e927b6835087
-
memory/360-12-0x0000000000000000-mapping.dmp
-
memory/376-525-0x0000000000000000-mapping.dmp
-
memory/420-41-0x0000000000000000-mapping.dmp
-
memory/492-493-0x0000000000000000-mapping.dmp
-
memory/536-552-0x0000000000000000-mapping.dmp
-
memory/608-6-0x0000000000000000-mapping.dmp
-
memory/684-17-0x0000000000000000-mapping.dmp
-
memory/728-30-0x0000000000000000-mapping.dmp
-
memory/760-249-0x0000000000000000-mapping.dmp
-
memory/808-40-0x0000000000000000-mapping.dmp
-
memory/852-0-0x00000000024DB000-0x00000000024DC000-memory.dmpFilesize
4KB
-
memory/892-279-0x0000000000000000-mapping.dmp
-
memory/988-28-0x0000000000000000-mapping.dmp
-
memory/992-129-0x0000000000000000-mapping.dmp
-
memory/1016-44-0x0000000000000000-mapping.dmp
-
memory/1036-38-0x0000000000000000-mapping.dmp
-
memory/1072-49-0x0000000000000000-mapping.dmp
-
memory/1096-286-0x0000000000000000-mapping.dmp
-
memory/1100-441-0x0000000000000000-mapping.dmp
-
memory/1108-34-0x0000000000000000-mapping.dmp
-
memory/1136-27-0x0000000000000000-mapping.dmp
-
memory/1156-15-0x0000000000000000-mapping.dmp
-
memory/1208-51-0x0000000000000000-mapping.dmp
-
memory/1252-95-0x0000000000000000-mapping.dmp
-
memory/1356-47-0x0000000000000000-mapping.dmp
-
memory/1364-35-0x0000000000000000-mapping.dmp
-
memory/1492-217-0x0000000000000000-mapping.dmp
-
memory/1496-10-0x0000000000000000-mapping.dmp
-
memory/1828-128-0x0000000000000000-mapping.dmp
-
memory/1916-16-0x0000000000000000-mapping.dmp
-
memory/1952-37-0x0000000000000000-mapping.dmp
-
memory/1956-24-0x0000000000000000-mapping.dmp
-
memory/1988-21-0x0000000000000000-mapping.dmp
-
memory/2008-9-0x0000000000000000-mapping.dmp
-
memory/2096-36-0x0000000000000000-mapping.dmp
-
memory/2100-48-0x0000000000000000-mapping.dmp
-
memory/2120-13-0x0000000000000000-mapping.dmp
-
memory/2140-45-0x0000000000000000-mapping.dmp
-
memory/2220-179-0x0000000000000000-mapping.dmp
-
memory/2224-274-0x0000000000000000-mapping.dmp
-
memory/2260-417-0x0000000000000000-mapping.dmp
-
memory/2320-52-0x0000000000000000-mapping.dmp
-
memory/2352-26-0x0000000000000000-mapping.dmp
-
memory/2364-5-0x0000000000000000-mapping.dmp
-
memory/2388-53-0x0000000000000000-mapping.dmp
-
memory/2392-201-0x0000000000000000-mapping.dmp
-
memory/2396-54-0x0000000000000000-mapping.dmp
-
memory/2404-96-0x0000000000000000-mapping.dmp
-
memory/2420-39-0x0000000000000000-mapping.dmp
-
memory/2424-55-0x0000000000000000-mapping.dmp
-
memory/2508-183-0x0000000000000000-mapping.dmp
-
memory/2680-1-0x0000000000000000-mapping.dmp
-
memory/2680-4-0x000000000270B000-0x000000000270C000-memory.dmpFilesize
4KB
-
memory/2684-180-0x0000000000000000-mapping.dmp
-
memory/2688-19-0x0000000000000000-mapping.dmp
-
memory/2708-431-0x0000000000000000-mapping.dmp
-
memory/2712-373-0x0000000000000000-mapping.dmp
-
memory/2716-25-0x0000000000000000-mapping.dmp
-
memory/2720-29-0x0000000000000000-mapping.dmp
-
memory/2760-43-0x0000000000000000-mapping.dmp
-
memory/2888-50-0x0000000000000000-mapping.dmp
-
memory/2896-32-0x0000000000000000-mapping.dmp
-
memory/2908-11-0x0000000000000000-mapping.dmp
-
memory/2960-273-0x0000000000000000-mapping.dmp
-
memory/3200-33-0x0000000000000000-mapping.dmp
-
memory/3308-295-0x0000000000000000-mapping.dmp
-
memory/3568-214-0x0000000000000000-mapping.dmp
-
memory/3592-20-0x0000000000000000-mapping.dmp
-
memory/3604-46-0x0000000000000000-mapping.dmp
-
memory/3640-31-0x0000000000000000-mapping.dmp
-
memory/3644-7-0x0000000000000000-mapping.dmp
-
memory/3648-22-0x0000000000000000-mapping.dmp
-
memory/3748-56-0x0000000000000000-mapping.dmp
-
memory/3824-14-0x0000000000000000-mapping.dmp
-
memory/3940-42-0x0000000000000000-mapping.dmp
-
memory/4100-222-0x0000000000000000-mapping.dmp
-
memory/4104-155-0x0000000000000000-mapping.dmp
-
memory/4108-57-0x0000000000000000-mapping.dmp
-
memory/4112-240-0x0000000000000000-mapping.dmp
-
memory/4116-311-0x0000000000000000-mapping.dmp
-
memory/4120-285-0x0000000000000000-mapping.dmp
-
memory/4124-203-0x0000000000000000-mapping.dmp
-
memory/4128-58-0x0000000000000000-mapping.dmp
-
memory/4132-99-0x0000000000000000-mapping.dmp
-
memory/4136-156-0x0000000000000000-mapping.dmp
-
memory/4140-221-0x0000000000000000-mapping.dmp
-
memory/4144-97-0x0000000000000000-mapping.dmp
-
memory/4148-185-0x0000000000000000-mapping.dmp
-
memory/4152-261-0x0000000000000000-mapping.dmp
-
memory/4156-134-0x0000000000000000-mapping.dmp
-
memory/4160-205-0x0000000000000000-mapping.dmp
-
memory/4164-131-0x0000000000000000-mapping.dmp
-
memory/4168-160-0x0000000000000000-mapping.dmp
-
memory/4172-165-0x0000000000000000-mapping.dmp
-
memory/4176-59-0x0000000000000000-mapping.dmp
-
memory/4180-316-0x0000000000000000-mapping.dmp
-
memory/4184-315-0x0000000000000000-mapping.dmp
-
memory/4188-130-0x0000000000000000-mapping.dmp
-
memory/4192-292-0x0000000000000000-mapping.dmp
-
memory/4196-60-0x0000000000000000-mapping.dmp
-
memory/4200-253-0x0000000000000000-mapping.dmp
-
memory/4204-98-0x0000000000000000-mapping.dmp
-
memory/4208-161-0x0000000000000000-mapping.dmp
-
memory/4212-224-0x0000000000000000-mapping.dmp
-
memory/4216-61-0x0000000000000000-mapping.dmp
-
memory/4220-162-0x0000000000000000-mapping.dmp
-
memory/4224-235-0x0000000000000000-mapping.dmp
-
memory/4228-206-0x0000000000000000-mapping.dmp
-
memory/4232-226-0x0000000000000000-mapping.dmp
-
memory/4236-62-0x0000000000000000-mapping.dmp
-
memory/4240-137-0x0000000000000000-mapping.dmp
-
memory/4244-100-0x0000000000000000-mapping.dmp
-
memory/4248-103-0x0000000000000000-mapping.dmp
-
memory/4252-204-0x0000000000000000-mapping.dmp
-
memory/4256-207-0x0000000000000000-mapping.dmp
-
memory/4260-284-0x0000000000000000-mapping.dmp
-
memory/4264-243-0x0000000000000000-mapping.dmp
-
memory/4268-223-0x0000000000000000-mapping.dmp
-
memory/4272-163-0x0000000000000000-mapping.dmp
-
memory/4276-280-0x0000000000000000-mapping.dmp
-
memory/4280-138-0x0000000000000000-mapping.dmp
-
memory/4284-63-0x0000000000000000-mapping.dmp
-
memory/4288-101-0x0000000000000000-mapping.dmp
-
memory/4292-301-0x0000000000000000-mapping.dmp
-
memory/4296-132-0x0000000000000000-mapping.dmp
-
memory/4300-281-0x0000000000000000-mapping.dmp
-
memory/4304-64-0x0000000000000000-mapping.dmp
-
memory/4308-290-0x0000000000000000-mapping.dmp
-
memory/4312-133-0x0000000000000000-mapping.dmp
-
memory/4316-304-0x0000000000000000-mapping.dmp
-
memory/4320-159-0x0000000000000000-mapping.dmp
-
memory/4324-65-0x0000000000000000-mapping.dmp
-
memory/4328-254-0x0000000000000000-mapping.dmp
-
memory/4332-102-0x0000000000000000-mapping.dmp
-
memory/4336-238-0x0000000000000000-mapping.dmp
-
memory/4340-251-0x0000000000000000-mapping.dmp
-
memory/4344-66-0x0000000000000000-mapping.dmp
-
memory/4348-275-0x0000000000000000-mapping.dmp
-
memory/4352-357-0x0000000000000000-mapping.dmp
-
memory/4356-256-0x0000000000000000-mapping.dmp
-
memory/4360-164-0x0000000000000000-mapping.dmp
-
memory/4364-140-0x0000000000000000-mapping.dmp
-
memory/4368-192-0x0000000000000000-mapping.dmp
-
memory/4372-106-0x0000000000000000-mapping.dmp
-
memory/4376-317-0x0000000000000000-mapping.dmp
-
memory/4380-230-0x0000000000000000-mapping.dmp
-
memory/4384-283-0x0000000000000000-mapping.dmp
-
memory/4388-306-0x0000000000000000-mapping.dmp
-
memory/4392-67-0x0000000000000000-mapping.dmp
-
memory/4396-288-0x0000000000000000-mapping.dmp
-
memory/4400-225-0x0000000000000000-mapping.dmp
-
memory/4404-104-0x0000000000000000-mapping.dmp
-
memory/4408-209-0x0000000000000000-mapping.dmp
-
memory/4412-68-0x0000000000000000-mapping.dmp
-
memory/4416-307-0x0000000000000000-mapping.dmp
-
memory/4420-135-0x0000000000000000-mapping.dmp
-
memory/4424-105-0x0000000000000000-mapping.dmp
-
memory/4428-291-0x0000000000000000-mapping.dmp
-
memory/4432-69-0x0000000000000000-mapping.dmp
-
memory/4436-188-0x0000000000000000-mapping.dmp
-
memory/4440-257-0x0000000000000000-mapping.dmp
-
memory/4444-136-0x0000000000000000-mapping.dmp
-
memory/4448-186-0x0000000000000000-mapping.dmp
-
memory/4452-70-0x0000000000000000-mapping.dmp
-
memory/4456-169-0x0000000000000000-mapping.dmp
-
memory/4460-141-0x0000000000000000-mapping.dmp
-
memory/4464-293-0x0000000000000000-mapping.dmp
-
memory/4468-189-0x0000000000000000-mapping.dmp
-
memory/4472-227-0x0000000000000000-mapping.dmp
-
memory/4476-462-0x0000000000000000-mapping.dmp
-
memory/4480-308-0x0000000000000000-mapping.dmp
-
memory/4484-110-0x0000000000000000-mapping.dmp
-
memory/4488-314-0x0000000000000000-mapping.dmp
-
memory/4492-166-0x0000000000000000-mapping.dmp
-
memory/4496-139-0x0000000000000000-mapping.dmp
-
memory/4500-71-0x0000000000000000-mapping.dmp
-
memory/4504-297-0x0000000000000000-mapping.dmp
-
memory/4508-260-0x0000000000000000-mapping.dmp
-
memory/4512-168-0x0000000000000000-mapping.dmp
-
memory/4516-107-0x0000000000000000-mapping.dmp
-
memory/4520-72-0x0000000000000000-mapping.dmp
-
memory/4524-190-0x0000000000000000-mapping.dmp
-
memory/4528-356-0x0000000000000000-mapping.dmp
-
memory/4532-167-0x0000000000000000-mapping.dmp
-
memory/4536-108-0x0000000000000000-mapping.dmp
-
memory/4540-191-0x0000000000000000-mapping.dmp
-
memory/4544-73-0x0000000000000000-mapping.dmp
-
memory/4548-109-0x0000000000000000-mapping.dmp
-
memory/4552-208-0x0000000000000000-mapping.dmp
-
memory/4556-187-0x0000000000000000-mapping.dmp
-
memory/4560-266-0x0000000000000000-mapping.dmp
-
memory/4564-74-0x0000000000000000-mapping.dmp
-
memory/4568-573-0x0000000000000000-mapping.dmp
-
memory/4572-144-0x0000000000000000-mapping.dmp
-
memory/4576-147-0x0000000000000000-mapping.dmp
-
memory/4580-143-0x0000000000000000-mapping.dmp
-
memory/4584-114-0x0000000000000000-mapping.dmp
-
memory/4588-215-0x0000000000000000-mapping.dmp
-
memory/4592-278-0x0000000000000000-mapping.dmp
-
memory/4596-195-0x0000000000000000-mapping.dmp
-
memory/4600-171-0x0000000000000000-mapping.dmp
-
memory/4604-113-0x0000000000000000-mapping.dmp
-
memory/4608-193-0x0000000000000000-mapping.dmp
-
memory/4612-75-0x0000000000000000-mapping.dmp
-
memory/4616-510-0x0000000000000000-mapping.dmp
-
memory/4620-212-0x0000000000000000-mapping.dmp
-
memory/4624-210-0x0000000000000000-mapping.dmp
-
memory/4628-170-0x0000000000000000-mapping.dmp
-
memory/4632-76-0x0000000000000000-mapping.dmp
-
memory/4636-142-0x0000000000000000-mapping.dmp
-
memory/4640-111-0x0000000000000000-mapping.dmp
-
memory/4644-241-0x0000000000000000-mapping.dmp
-
memory/4648-312-0x0000000000000000-mapping.dmp
-
memory/4652-77-0x0000000000000000-mapping.dmp
-
memory/4656-245-0x0000000000000000-mapping.dmp
-
memory/4660-619-0x0000000000000000-mapping.dmp
-
memory/4664-213-0x0000000000000000-mapping.dmp
-
memory/4668-112-0x0000000000000000-mapping.dmp
-
memory/4672-78-0x0000000000000000-mapping.dmp
-
memory/4676-211-0x0000000000000000-mapping.dmp
-
memory/4680-232-0x0000000000000000-mapping.dmp
-
memory/4684-229-0x0000000000000000-mapping.dmp
-
memory/4688-289-0x0000000000000000-mapping.dmp
-
memory/4692-259-0x0000000000000000-mapping.dmp
-
memory/4696-268-0x0000000000000000-mapping.dmp
-
memory/4700-252-0x0000000000000000-mapping.dmp
-
memory/4704-303-0x0000000000000000-mapping.dmp
-
memory/4708-117-0x0000000000000000-mapping.dmp
-
memory/4712-146-0x0000000000000000-mapping.dmp
-
memory/4716-116-0x0000000000000000-mapping.dmp
-
memory/4720-79-0x0000000000000000-mapping.dmp
-
memory/4724-269-0x0000000000000000-mapping.dmp
-
memory/4728-145-0x0000000000000000-mapping.dmp
-
memory/4732-194-0x0000000000000000-mapping.dmp
-
memory/4736-219-0x0000000000000000-mapping.dmp
-
memory/4740-80-0x0000000000000000-mapping.dmp
-
memory/4744-231-0x0000000000000000-mapping.dmp
-
memory/4748-313-0x0000000000000000-mapping.dmp
-
memory/4752-461-0x0000000000000000-mapping.dmp
-
memory/4756-172-0x0000000000000000-mapping.dmp
-
memory/4760-81-0x0000000000000000-mapping.dmp
-
memory/4764-298-0x0000000000000000-mapping.dmp
-
memory/4768-115-0x0000000000000000-mapping.dmp
-
memory/4772-242-0x0000000000000000-mapping.dmp
-
memory/4776-264-0x0000000000000000-mapping.dmp
-
memory/4780-82-0x0000000000000000-mapping.dmp
-
memory/4784-120-0x0000000000000000-mapping.dmp
-
memory/4788-299-0x0000000000000000-mapping.dmp
-
memory/4792-216-0x0000000000000000-mapping.dmp
-
memory/4796-118-0x0000000000000000-mapping.dmp
-
memory/4800-276-0x0000000000000000-mapping.dmp
-
memory/4804-247-0x0000000000000000-mapping.dmp
-
memory/4808-270-0x0000000000000000-mapping.dmp
-
memory/4812-149-0x0000000000000000-mapping.dmp
-
memory/4816-174-0x0000000000000000-mapping.dmp
-
memory/4820-173-0x0000000000000000-mapping.dmp
-
memory/4824-262-0x0000000000000000-mapping.dmp
-
memory/4828-83-0x0000000000000000-mapping.dmp
-
memory/4832-148-0x0000000000000000-mapping.dmp
-
memory/4836-300-0x0000000000000000-mapping.dmp
-
memory/4840-228-0x0000000000000000-mapping.dmp
-
memory/4844-151-0x0000000000000000-mapping.dmp
-
memory/4848-84-0x0000000000000000-mapping.dmp
-
memory/4852-287-0x0000000000000000-mapping.dmp
-
memory/4856-178-0x0000000000000000-mapping.dmp
-
memory/4860-175-0x0000000000000000-mapping.dmp
-
memory/4864-282-0x0000000000000000-mapping.dmp
-
memory/4868-85-0x0000000000000000-mapping.dmp
-
memory/4872-271-0x0000000000000000-mapping.dmp
-
memory/4876-416-0x0000000000000000-mapping.dmp
-
memory/4880-119-0x0000000000000000-mapping.dmp
-
memory/4884-199-0x0000000000000000-mapping.dmp
-
memory/4888-86-0x0000000000000000-mapping.dmp
-
memory/4892-196-0x0000000000000000-mapping.dmp
-
memory/4896-121-0x0000000000000000-mapping.dmp
-
memory/4900-124-0x0000000000000000-mapping.dmp
-
memory/4904-263-0x0000000000000000-mapping.dmp
-
memory/4908-355-0x0000000000000000-mapping.dmp
-
memory/4912-267-0x0000000000000000-mapping.dmp
-
memory/4916-154-0x0000000000000000-mapping.dmp
-
memory/4920-123-0x0000000000000000-mapping.dmp
-
memory/4924-152-0x0000000000000000-mapping.dmp
-
memory/4928-202-0x0000000000000000-mapping.dmp
-
memory/4932-182-0x0000000000000000-mapping.dmp
-
memory/4936-87-0x0000000000000000-mapping.dmp
-
memory/4940-296-0x0000000000000000-mapping.dmp
-
memory/4944-150-0x0000000000000000-mapping.dmp
-
memory/4948-294-0x0000000000000000-mapping.dmp
-
memory/4952-122-0x0000000000000000-mapping.dmp
-
memory/4956-88-0x0000000000000000-mapping.dmp
-
memory/4960-181-0x0000000000000000-mapping.dmp
-
memory/4964-302-0x0000000000000000-mapping.dmp
-
memory/4968-255-0x0000000000000000-mapping.dmp
-
memory/4972-389-0x0000000000000000-mapping.dmp
-
memory/4976-89-0x0000000000000000-mapping.dmp
-
memory/4980-236-0x0000000000000000-mapping.dmp
-
memory/4984-234-0x0000000000000000-mapping.dmp
-
memory/4988-265-0x0000000000000000-mapping.dmp
-
memory/4992-305-0x0000000000000000-mapping.dmp
-
memory/4996-90-0x0000000000000000-mapping.dmp
-
memory/5000-220-0x0000000000000000-mapping.dmp
-
memory/5004-233-0x0000000000000000-mapping.dmp
-
memory/5008-248-0x0000000000000000-mapping.dmp
-
memory/5012-176-0x0000000000000000-mapping.dmp
-
memory/5016-127-0x0000000000000000-mapping.dmp
-
memory/5020-277-0x0000000000000000-mapping.dmp
-
memory/5024-158-0x0000000000000000-mapping.dmp
-
memory/5028-244-0x0000000000000000-mapping.dmp
-
memory/5032-157-0x0000000000000000-mapping.dmp
-
memory/5036-218-0x0000000000000000-mapping.dmp
-
memory/5040-310-0x0000000000000000-mapping.dmp
-
memory/5044-91-0x0000000000000000-mapping.dmp
-
memory/5048-197-0x0000000000000000-mapping.dmp
-
memory/5052-246-0x0000000000000000-mapping.dmp
-
memory/5056-125-0x0000000000000000-mapping.dmp
-
memory/5060-177-0x0000000000000000-mapping.dmp
-
memory/5064-92-0x0000000000000000-mapping.dmp
-
memory/5068-126-0x0000000000000000-mapping.dmp
-
memory/5072-153-0x0000000000000000-mapping.dmp
-
memory/5076-309-0x0000000000000000-mapping.dmp
-
memory/5080-198-0x0000000000000000-mapping.dmp
-
memory/5084-93-0x0000000000000000-mapping.dmp
-
memory/5088-272-0x0000000000000000-mapping.dmp
-
memory/5092-200-0x0000000000000000-mapping.dmp
-
memory/5096-250-0x0000000000000000-mapping.dmp
-
memory/5100-237-0x0000000000000000-mapping.dmp
-
memory/5104-94-0x0000000000000000-mapping.dmp
-
memory/5108-184-0x0000000000000000-mapping.dmp
-
memory/5112-258-0x0000000000000000-mapping.dmp
-
memory/5116-239-0x0000000000000000-mapping.dmp
-
memory/5124-450-0x0000000000000000-mapping.dmp
-
memory/5128-318-0x0000000000000000-mapping.dmp
-
memory/5132-572-0x0000000000000000-mapping.dmp
-
memory/5136-498-0x0000000000000000-mapping.dmp
-
memory/5140-464-0x0000000000000000-mapping.dmp
-
memory/5144-529-0x0000000000000000-mapping.dmp
-
memory/5148-360-0x0000000000000000-mapping.dmp
-
memory/5152-465-0x0000000000000000-mapping.dmp
-
memory/5156-470-0x0000000000000000-mapping.dmp
-
memory/5160-359-0x0000000000000000-mapping.dmp
-
memory/5164-392-0x0000000000000000-mapping.dmp
-
memory/5168-419-0x0000000000000000-mapping.dmp
-
memory/5172-508-0x0000000000000000-mapping.dmp
-
memory/5176-319-0x0000000000000000-mapping.dmp
-
memory/5180-358-0x0000000000000000-mapping.dmp
-
memory/5184-467-0x0000000000000000-mapping.dmp
-
memory/5188-390-0x0000000000000000-mapping.dmp
-
memory/5192-482-0x0000000000000000-mapping.dmp
-
memory/5196-320-0x0000000000000000-mapping.dmp
-
memory/5200-448-0x0000000000000000-mapping.dmp
-
memory/5204-391-0x0000000000000000-mapping.dmp
-
memory/5208-443-0x0000000000000000-mapping.dmp
-
memory/5212-504-0x0000000000000000-mapping.dmp
-
memory/5216-321-0x0000000000000000-mapping.dmp
-
memory/5220-425-0x0000000000000000-mapping.dmp
-
memory/5224-523-0x0000000000000000-mapping.dmp
-
memory/5228-468-0x0000000000000000-mapping.dmp
-
memory/5232-394-0x0000000000000000-mapping.dmp
-
memory/5236-322-0x0000000000000000-mapping.dmp
-
memory/5240-740-0x0000000000000000-mapping.dmp
-
memory/5244-420-0x0000000000000000-mapping.dmp
-
memory/5248-447-0x0000000000000000-mapping.dmp
-
memory/5252-522-0x0000000000000000-mapping.dmp
-
memory/5256-566-0x0000000000000000-mapping.dmp
-
memory/5260-424-0x0000000000000000-mapping.dmp
-
memory/5264-398-0x0000000000000000-mapping.dmp
-
memory/5268-486-0x0000000000000000-mapping.dmp
-
memory/5272-363-0x0000000000000000-mapping.dmp
-
memory/5276-469-0x0000000000000000-mapping.dmp
-
memory/5280-397-0x0000000000000000-mapping.dmp
-
memory/5284-323-0x0000000000000000-mapping.dmp
-
memory/5288-361-0x0000000000000000-mapping.dmp
-
memory/5292-501-0x0000000000000000-mapping.dmp
-
memory/5296-519-0x0000000000000000-mapping.dmp
-
memory/5300-393-0x0000000000000000-mapping.dmp
-
memory/5304-324-0x0000000000000000-mapping.dmp
-
memory/5308-362-0x0000000000000000-mapping.dmp
-
memory/5312-444-0x0000000000000000-mapping.dmp
-
memory/5316-526-0x0000000000000000-mapping.dmp
-
memory/5320-620-0x0000000000000000-mapping.dmp
-
memory/5324-325-0x0000000000000000-mapping.dmp
-
memory/5328-514-0x0000000000000000-mapping.dmp
-
memory/5332-557-0x0000000000000000-mapping.dmp
-
memory/5336-426-0x0000000000000000-mapping.dmp
-
memory/5340-429-0x0000000000000000-mapping.dmp
-
memory/5344-326-0x0000000000000000-mapping.dmp
-
memory/5348-427-0x0000000000000000-mapping.dmp
-
memory/5352-395-0x0000000000000000-mapping.dmp
-
memory/5356-518-0x0000000000000000-mapping.dmp
-
memory/5360-528-0x0000000000000000-mapping.dmp
-
memory/5364-777-0x0000000000000000-mapping.dmp
-
memory/5368-452-0x0000000000000000-mapping.dmp
-
memory/5372-551-0x0000000000000000-mapping.dmp
-
memory/5376-558-0x0000000000000000-mapping.dmp
-
memory/5380-490-0x0000000000000000-mapping.dmp
-
memory/5384-564-0x0000000000000000-mapping.dmp
-
memory/5388-741-0x0000000000000000-mapping.dmp
-
memory/5392-327-0x0000000000000000-mapping.dmp
-
memory/5396-535-0x0000000000000000-mapping.dmp
-
memory/5400-364-0x0000000000000000-mapping.dmp
-
memory/5404-499-0x0000000000000000-mapping.dmp
-
memory/5408-396-0x0000000000000000-mapping.dmp
-
memory/5412-328-0x0000000000000000-mapping.dmp
-
memory/5416-576-0x0000000000000000-mapping.dmp
-
memory/5420-449-0x0000000000000000-mapping.dmp
-
memory/5424-423-0x0000000000000000-mapping.dmp
-
memory/5428-365-0x0000000000000000-mapping.dmp
-
memory/5432-329-0x0000000000000000-mapping.dmp
-
memory/5436-366-0x0000000000000000-mapping.dmp
-
memory/5440-484-0x0000000000000000-mapping.dmp
-
memory/5444-401-0x0000000000000000-mapping.dmp
-
memory/5448-540-0x0000000000000000-mapping.dmp
-
memory/5452-330-0x0000000000000000-mapping.dmp
-
memory/5456-402-0x0000000000000000-mapping.dmp
-
memory/5460-471-0x0000000000000000-mapping.dmp
-
memory/5464-513-0x0000000000000000-mapping.dmp
-
memory/5468-367-0x0000000000000000-mapping.dmp
-
memory/5472-548-0x0000000000000000-mapping.dmp
-
memory/5476-405-0x0000000000000000-mapping.dmp
-
memory/5480-400-0x0000000000000000-mapping.dmp
-
memory/5484-370-0x0000000000000000-mapping.dmp
-
memory/5488-578-0x0000000000000000-mapping.dmp
-
memory/5492-494-0x0000000000000000-mapping.dmp
-
memory/5496-487-0x0000000000000000-mapping.dmp
-
memory/5500-331-0x0000000000000000-mapping.dmp
-
memory/5504-527-0x0000000000000000-mapping.dmp
-
memory/5508-489-0x0000000000000000-mapping.dmp
-
memory/5512-571-0x0000000000000000-mapping.dmp
-
memory/5516-568-0x0000000000000000-mapping.dmp
-
memory/5520-332-0x0000000000000000-mapping.dmp
-
memory/5524-399-0x0000000000000000-mapping.dmp
-
memory/5528-368-0x0000000000000000-mapping.dmp
-
memory/5532-428-0x0000000000000000-mapping.dmp
-
memory/5536-502-0x0000000000000000-mapping.dmp
-
memory/5540-333-0x0000000000000000-mapping.dmp
-
memory/5544-453-0x0000000000000000-mapping.dmp
-
memory/5548-543-0x0000000000000000-mapping.dmp
-
memory/5552-473-0x0000000000000000-mapping.dmp
-
memory/5556-369-0x0000000000000000-mapping.dmp
-
memory/5560-334-0x0000000000000000-mapping.dmp
-
memory/5564-374-0x0000000000000000-mapping.dmp
-
memory/5568-531-0x0000000000000000-mapping.dmp
-
memory/5572-533-0x0000000000000000-mapping.dmp
-
memory/5576-404-0x0000000000000000-mapping.dmp
-
memory/5580-509-0x0000000000000000-mapping.dmp
-
memory/5584-433-0x0000000000000000-mapping.dmp
-
memory/5588-403-0x0000000000000000-mapping.dmp
-
memory/5592-451-0x0000000000000000-mapping.dmp
-
memory/5596-542-0x0000000000000000-mapping.dmp
-
memory/5600-520-0x0000000000000000-mapping.dmp
-
memory/5604-455-0x0000000000000000-mapping.dmp
-
memory/5608-335-0x0000000000000000-mapping.dmp
-
memory/5612-569-0x0000000000000000-mapping.dmp
-
memory/5616-472-0x0000000000000000-mapping.dmp
-
memory/5620-430-0x0000000000000000-mapping.dmp
-
memory/5624-371-0x0000000000000000-mapping.dmp
-
memory/5628-336-0x0000000000000000-mapping.dmp
-
memory/5632-432-0x0000000000000000-mapping.dmp
-
memory/5636-516-0x0000000000000000-mapping.dmp
-
memory/5640-488-0x0000000000000000-mapping.dmp
-
memory/5644-545-0x0000000000000000-mapping.dmp
-
memory/5648-337-0x0000000000000000-mapping.dmp
-
memory/5652-474-0x0000000000000000-mapping.dmp
-
memory/5656-372-0x0000000000000000-mapping.dmp
-
memory/5660-454-0x0000000000000000-mapping.dmp
-
memory/5664-505-0x0000000000000000-mapping.dmp
-
memory/5668-338-0x0000000000000000-mapping.dmp
-
memory/5672-377-0x0000000000000000-mapping.dmp
-
memory/5676-538-0x0000000000000000-mapping.dmp
-
memory/5680-378-0x0000000000000000-mapping.dmp
-
memory/5684-779-0x0000000000000000-mapping.dmp
-
memory/5688-496-0x0000000000000000-mapping.dmp
-
memory/5692-575-0x0000000000000000-mapping.dmp
-
memory/5696-477-0x0000000000000000-mapping.dmp
-
memory/5700-459-0x0000000000000000-mapping.dmp
-
memory/5704-435-0x0000000000000000-mapping.dmp
-
memory/5708-457-0x0000000000000000-mapping.dmp
-
memory/5712-475-0x0000000000000000-mapping.dmp
-
memory/5716-339-0x0000000000000000-mapping.dmp
-
memory/5720-408-0x0000000000000000-mapping.dmp
-
memory/5724-560-0x0000000000000000-mapping.dmp
-
memory/5728-407-0x0000000000000000-mapping.dmp
-
memory/5732-507-0x0000000000000000-mapping.dmp
-
memory/5736-340-0x0000000000000000-mapping.dmp
-
memory/5740-456-0x0000000000000000-mapping.dmp
-
memory/5744-539-0x0000000000000000-mapping.dmp
-
memory/5748-479-0x0000000000000000-mapping.dmp
-
memory/5752-375-0x0000000000000000-mapping.dmp
-
memory/5756-341-0x0000000000000000-mapping.dmp
-
memory/5760-376-0x0000000000000000-mapping.dmp
-
memory/5764-406-0x0000000000000000-mapping.dmp
-
memory/5768-565-0x0000000000000000-mapping.dmp
-
memory/5772-521-0x0000000000000000-mapping.dmp
-
memory/5776-342-0x0000000000000000-mapping.dmp
-
memory/5780-506-0x0000000000000000-mapping.dmp
-
memory/5784-555-0x0000000000000000-mapping.dmp
-
memory/5788-491-0x0000000000000000-mapping.dmp
-
memory/5792-476-0x0000000000000000-mapping.dmp
-
memory/5796-381-0x0000000000000000-mapping.dmp
-
memory/5800-410-0x0000000000000000-mapping.dmp
-
memory/5804-409-0x0000000000000000-mapping.dmp
-
memory/5808-380-0x0000000000000000-mapping.dmp
-
memory/5812-478-0x0000000000000000-mapping.dmp
-
memory/5816-549-0x0000000000000000-mapping.dmp
-
memory/5820-652-0x0000000000000000-mapping.dmp
-
memory/5824-343-0x0000000000000000-mapping.dmp
-
memory/5828-434-0x0000000000000000-mapping.dmp
-
memory/5832-436-0x0000000000000000-mapping.dmp
-
memory/5836-547-0x0000000000000000-mapping.dmp
-
memory/5840-458-0x0000000000000000-mapping.dmp
-
memory/5844-344-0x0000000000000000-mapping.dmp
-
memory/5848-554-0x0000000000000000-mapping.dmp
-
memory/5852-483-0x0000000000000000-mapping.dmp
-
memory/5856-411-0x0000000000000000-mapping.dmp
-
memory/5860-567-0x0000000000000000-mapping.dmp
-
memory/5864-345-0x0000000000000000-mapping.dmp
-
memory/5868-379-0x0000000000000000-mapping.dmp
-
memory/5872-460-0x0000000000000000-mapping.dmp
-
memory/5876-570-0x0000000000000000-mapping.dmp
-
memory/5880-559-0x0000000000000000-mapping.dmp
-
memory/5884-346-0x0000000000000000-mapping.dmp
-
memory/5888-480-0x0000000000000000-mapping.dmp
-
memory/5892-574-0x0000000000000000-mapping.dmp
-
memory/5896-495-0x0000000000000000-mapping.dmp
-
memory/5900-553-0x0000000000000000-mapping.dmp
-
memory/5904-438-0x0000000000000000-mapping.dmp
-
memory/5908-561-0x0000000000000000-mapping.dmp
-
memory/5912-511-0x0000000000000000-mapping.dmp
-
memory/5916-492-0x0000000000000000-mapping.dmp
-
memory/5920-384-0x0000000000000000-mapping.dmp
-
memory/5924-412-0x0000000000000000-mapping.dmp
-
memory/5928-383-0x0000000000000000-mapping.dmp
-
memory/5932-347-0x0000000000000000-mapping.dmp
-
memory/5936-382-0x0000000000000000-mapping.dmp
-
memory/5940-439-0x0000000000000000-mapping.dmp
-
memory/5944-517-0x0000000000000000-mapping.dmp
-
memory/5948-437-0x0000000000000000-mapping.dmp
-
memory/5952-348-0x0000000000000000-mapping.dmp
-
memory/5956-463-0x0000000000000000-mapping.dmp
-
memory/5960-515-0x0000000000000000-mapping.dmp
-
memory/5964-544-0x0000000000000000-mapping.dmp
-
memory/5968-742-0x0000000000000000-mapping.dmp
-
memory/5972-349-0x0000000000000000-mapping.dmp
-
memory/5976-550-0x0000000000000000-mapping.dmp
-
memory/5980-532-0x0000000000000000-mapping.dmp
-
memory/5984-810-0x0000000000000000-mapping.dmp
-
memory/5988-556-0x0000000000000000-mapping.dmp
-
memory/5992-350-0x0000000000000000-mapping.dmp
-
memory/5996-546-0x0000000000000000-mapping.dmp
-
memory/6000-537-0x0000000000000000-mapping.dmp
-
memory/6004-497-0x0000000000000000-mapping.dmp
-
memory/6008-413-0x0000000000000000-mapping.dmp
-
memory/6012-524-0x0000000000000000-mapping.dmp
-
memory/6016-387-0x0000000000000000-mapping.dmp
-
memory/6020-562-0x0000000000000000-mapping.dmp
-
memory/6024-530-0x0000000000000000-mapping.dmp
-
memory/6028-541-0x0000000000000000-mapping.dmp
-
memory/6032-418-0x0000000000000000-mapping.dmp
-
memory/6036-446-0x0000000000000000-mapping.dmp
-
memory/6040-351-0x0000000000000000-mapping.dmp
-
memory/6044-414-0x0000000000000000-mapping.dmp
-
memory/6048-385-0x0000000000000000-mapping.dmp
-
memory/6052-481-0x0000000000000000-mapping.dmp
-
memory/6056-512-0x0000000000000000-mapping.dmp
-
memory/6060-352-0x0000000000000000-mapping.dmp
-
memory/6064-442-0x0000000000000000-mapping.dmp
-
memory/6068-500-0x0000000000000000-mapping.dmp
-
memory/6072-503-0x0000000000000000-mapping.dmp
-
memory/6076-386-0x0000000000000000-mapping.dmp
-
memory/6080-353-0x0000000000000000-mapping.dmp
-
memory/6084-563-0x0000000000000000-mapping.dmp
-
memory/6088-536-0x0000000000000000-mapping.dmp
-
memory/6092-466-0x0000000000000000-mapping.dmp
-
memory/6096-415-0x0000000000000000-mapping.dmp
-
memory/6100-354-0x0000000000000000-mapping.dmp
-
memory/6104-421-0x0000000000000000-mapping.dmp
-
memory/6108-440-0x0000000000000000-mapping.dmp
-
memory/6112-705-0x0000000000000000-mapping.dmp
-
memory/6116-388-0x0000000000000000-mapping.dmp
-
memory/6120-445-0x0000000000000000-mapping.dmp
-
memory/6124-534-0x0000000000000000-mapping.dmp
-
memory/6128-577-0x0000000000000000-mapping.dmp
-
memory/6132-422-0x0000000000000000-mapping.dmp
-
memory/6136-485-0x0000000000000000-mapping.dmp
-
memory/6140-579-0x0000000000000000-mapping.dmp
-
memory/6148-618-0x0000000000000000-mapping.dmp
-
memory/6152-758-0x0000000000000000-mapping.dmp
-
memory/6156-768-0x0000000000000000-mapping.dmp
-
memory/6160-580-0x0000000000000000-mapping.dmp
-
memory/6164-703-0x0000000000000000-mapping.dmp
-
memory/6168-651-0x0000000000000000-mapping.dmp
-
memory/6172-707-0x0000000000000000-mapping.dmp
-
memory/6176-685-0x0000000000000000-mapping.dmp
-
memory/6180-581-0x0000000000000000-mapping.dmp
-
memory/6184-783-0x0000000000000000-mapping.dmp
-
memory/6188-654-0x0000000000000000-mapping.dmp
-
memory/6192-759-0x0000000000000000-mapping.dmp
-
memory/6196-729-0x0000000000000000-mapping.dmp
-
memory/6200-582-0x0000000000000000-mapping.dmp
-
memory/6204-623-0x0000000000000000-mapping.dmp
-
memory/6208-828-0x0000000000000000-mapping.dmp
-
memory/6212-655-0x0000000000000000-mapping.dmp
-
memory/6216-621-0x0000000000000000-mapping.dmp
-
memory/6220-763-0x0000000000000000-mapping.dmp
-
memory/6224-832-0x0000000000000000-mapping.dmp
-
memory/6228-781-0x0000000000000000-mapping.dmp
-
memory/6236-820-0x0000000000000000-mapping.dmp
-
memory/6240-657-0x0000000000000000-mapping.dmp
-
memory/6244-658-0x0000000000000000-mapping.dmp
-
memory/6248-583-0x0000000000000000-mapping.dmp
-
memory/6252-679-0x0000000000000000-mapping.dmp
-
memory/6256-680-0x0000000000000000-mapping.dmp
-
memory/6260-653-0x0000000000000000-mapping.dmp
-
memory/6264-760-0x0000000000000000-mapping.dmp
-
memory/6268-584-0x0000000000000000-mapping.dmp
-
memory/6272-799-0x0000000000000000-mapping.dmp
-
memory/6276-622-0x0000000000000000-mapping.dmp
-
memory/6280-744-0x0000000000000000-mapping.dmp
-
memory/6284-745-0x0000000000000000-mapping.dmp
-
memory/6288-585-0x0000000000000000-mapping.dmp
-
memory/6292-683-0x0000000000000000-mapping.dmp
-
memory/6296-684-0x0000000000000000-mapping.dmp
-
memory/6300-708-0x0000000000000000-mapping.dmp
-
memory/6304-823-0x0000000000000000-mapping.dmp
-
memory/6308-586-0x0000000000000000-mapping.dmp
-
memory/6312-660-0x0000000000000000-mapping.dmp
-
memory/6316-624-0x0000000000000000-mapping.dmp
-
memory/6320-627-0x0000000000000000-mapping.dmp
-
memory/6324-727-0x0000000000000000-mapping.dmp
-
memory/6328-712-0x0000000000000000-mapping.dmp
-
memory/6332-821-0x0000000000000000-mapping.dmp
-
memory/6336-816-0x0000000000000000-mapping.dmp
-
memory/6340-811-0x0000000000000000-mapping.dmp
-
memory/6344-791-0x0000000000000000-mapping.dmp
-
memory/6348-661-0x0000000000000000-mapping.dmp
-
memory/6356-587-0x0000000000000000-mapping.dmp
-
memory/6360-625-0x0000000000000000-mapping.dmp
-
memory/6364-743-0x0000000000000000-mapping.dmp
-
memory/6372-709-0x0000000000000000-mapping.dmp
-
memory/6376-588-0x0000000000000000-mapping.dmp
-
memory/6380-774-0x0000000000000000-mapping.dmp
-
memory/6384-746-0x0000000000000000-mapping.dmp
-
memory/6388-769-0x0000000000000000-mapping.dmp
-
memory/6392-656-0x0000000000000000-mapping.dmp
-
memory/6396-589-0x0000000000000000-mapping.dmp
-
memory/6400-733-0x0000000000000000-mapping.dmp
-
memory/6404-626-0x0000000000000000-mapping.dmp
-
memory/6412-728-0x0000000000000000-mapping.dmp
-
memory/6416-590-0x0000000000000000-mapping.dmp
-
memory/6420-662-0x0000000000000000-mapping.dmp
-
memory/6424-761-0x0000000000000000-mapping.dmp
-
memory/6428-732-0x0000000000000000-mapping.dmp
-
memory/6436-689-0x0000000000000000-mapping.dmp
-
memory/6440-827-0x0000000000000000-mapping.dmp
-
memory/6444-664-0x0000000000000000-mapping.dmp
-
memory/6452-750-0x0000000000000000-mapping.dmp
-
memory/6456-690-0x0000000000000000-mapping.dmp
-
memory/6460-630-0x0000000000000000-mapping.dmp
-
memory/6464-591-0x0000000000000000-mapping.dmp
-
memory/6468-659-0x0000000000000000-mapping.dmp
-
memory/6472-711-0x0000000000000000-mapping.dmp
-
memory/6476-628-0x0000000000000000-mapping.dmp
-
memory/6480-730-0x0000000000000000-mapping.dmp
-
memory/6484-592-0x0000000000000000-mapping.dmp
-
memory/6488-629-0x0000000000000000-mapping.dmp
-
memory/6492-688-0x0000000000000000-mapping.dmp
-
memory/6496-710-0x0000000000000000-mapping.dmp
-
memory/6500-687-0x0000000000000000-mapping.dmp
-
memory/6504-593-0x0000000000000000-mapping.dmp
-
memory/6508-686-0x0000000000000000-mapping.dmp
-
memory/6512-782-0x0000000000000000-mapping.dmp
-
memory/6520-792-0x0000000000000000-mapping.dmp
-
memory/6524-594-0x0000000000000000-mapping.dmp
-
memory/6528-634-0x0000000000000000-mapping.dmp
-
memory/6532-793-0x0000000000000000-mapping.dmp
-
memory/6536-772-0x0000000000000000-mapping.dmp
-
memory/6540-776-0x0000000000000000-mapping.dmp
-
memory/6544-668-0x0000000000000000-mapping.dmp
-
memory/6548-796-0x0000000000000000-mapping.dmp
-
memory/6552-825-0x0000000000000000-mapping.dmp
-
memory/6556-663-0x0000000000000000-mapping.dmp
-
memory/6560-665-0x0000000000000000-mapping.dmp
-
memory/6564-752-0x0000000000000000-mapping.dmp
-
memory/6568-731-0x0000000000000000-mapping.dmp
-
memory/6572-595-0x0000000000000000-mapping.dmp
-
memory/6576-631-0x0000000000000000-mapping.dmp
-
memory/6580-817-0x0000000000000000-mapping.dmp
-
memory/6584-815-0x0000000000000000-mapping.dmp
-
memory/6588-735-0x0000000000000000-mapping.dmp
-
memory/6592-596-0x0000000000000000-mapping.dmp
-
memory/6596-765-0x0000000000000000-mapping.dmp
-
memory/6600-749-0x0000000000000000-mapping.dmp
-
memory/6604-632-0x0000000000000000-mapping.dmp
-
memory/6608-771-0x0000000000000000-mapping.dmp
-
memory/6612-597-0x0000000000000000-mapping.dmp
-
memory/6616-691-0x0000000000000000-mapping.dmp
-
memory/6620-713-0x0000000000000000-mapping.dmp
-
memory/6624-633-0x0000000000000000-mapping.dmp
-
memory/6628-788-0x0000000000000000-mapping.dmp
-
memory/6632-598-0x0000000000000000-mapping.dmp
-
memory/6636-767-0x0000000000000000-mapping.dmp
-
memory/6640-797-0x0000000000000000-mapping.dmp
-
memory/6644-638-0x0000000000000000-mapping.dmp
-
memory/6648-806-0x0000000000000000-mapping.dmp
-
memory/6652-770-0x0000000000000000-mapping.dmp
-
memory/6656-755-0x0000000000000000-mapping.dmp
-
memory/6660-754-0x0000000000000000-mapping.dmp
-
memory/6664-637-0x0000000000000000-mapping.dmp
-
memory/6668-778-0x0000000000000000-mapping.dmp
-
memory/6672-747-0x0000000000000000-mapping.dmp
-
memory/6676-789-0x0000000000000000-mapping.dmp
-
memory/6680-599-0x0000000000000000-mapping.dmp
-
memory/6684-824-0x0000000000000000-mapping.dmp
-
memory/6688-739-0x0000000000000000-mapping.dmp
-
memory/6692-714-0x0000000000000000-mapping.dmp
-
memory/6696-667-0x0000000000000000-mapping.dmp
-
memory/6700-600-0x0000000000000000-mapping.dmp
-
memory/6704-734-0x0000000000000000-mapping.dmp
-
memory/6708-716-0x0000000000000000-mapping.dmp
-
memory/6712-666-0x0000000000000000-mapping.dmp
-
memory/6716-635-0x0000000000000000-mapping.dmp
-
memory/6720-601-0x0000000000000000-mapping.dmp
-
memory/6724-636-0x0000000000000000-mapping.dmp
-
memory/6728-818-0x0000000000000000-mapping.dmp
-
memory/6732-692-0x0000000000000000-mapping.dmp
-
memory/6736-715-0x0000000000000000-mapping.dmp
-
memory/6740-602-0x0000000000000000-mapping.dmp
-
memory/6744-694-0x0000000000000000-mapping.dmp
-
memory/6748-831-0x0000000000000000-mapping.dmp
-
memory/6752-812-0x0000000000000000-mapping.dmp
-
memory/6756-780-0x0000000000000000-mapping.dmp
-
memory/6760-762-0x0000000000000000-mapping.dmp
-
memory/6764-748-0x0000000000000000-mapping.dmp
-
memory/6768-669-0x0000000000000000-mapping.dmp
-
memory/6772-641-0x0000000000000000-mapping.dmp
-
memory/6776-670-0x0000000000000000-mapping.dmp
-
memory/6780-640-0x0000000000000000-mapping.dmp
-
memory/6784-756-0x0000000000000000-mapping.dmp
-
memory/6788-603-0x0000000000000000-mapping.dmp
-
memory/6792-693-0x0000000000000000-mapping.dmp
-
memory/6796-826-0x0000000000000000-mapping.dmp
-
memory/6800-719-0x0000000000000000-mapping.dmp
-
memory/6804-819-0x0000000000000000-mapping.dmp
-
memory/6808-604-0x0000000000000000-mapping.dmp
-
memory/6812-800-0x0000000000000000-mapping.dmp
-
memory/6816-790-0x0000000000000000-mapping.dmp
-
memory/6820-698-0x0000000000000000-mapping.dmp
-
memory/6824-671-0x0000000000000000-mapping.dmp
-
memory/6828-605-0x0000000000000000-mapping.dmp
-
memory/6832-736-0x0000000000000000-mapping.dmp
-
memory/6836-809-0x0000000000000000-mapping.dmp
-
memory/6844-639-0x0000000000000000-mapping.dmp
-
memory/6848-606-0x0000000000000000-mapping.dmp
-
memory/6852-833-0x0000000000000000-mapping.dmp
-
memory/6856-737-0x0000000000000000-mapping.dmp
-
memory/6860-829-0x0000000000000000-mapping.dmp
-
memory/6864-784-0x0000000000000000-mapping.dmp
-
memory/6868-672-0x0000000000000000-mapping.dmp
-
memory/6872-673-0x0000000000000000-mapping.dmp
-
memory/6876-702-0x0000000000000000-mapping.dmp
-
memory/6880-753-0x0000000000000000-mapping.dmp
-
memory/6884-644-0x0000000000000000-mapping.dmp
-
memory/6888-775-0x0000000000000000-mapping.dmp
-
memory/6892-643-0x0000000000000000-mapping.dmp
-
memory/6896-607-0x0000000000000000-mapping.dmp
-
memory/6900-642-0x0000000000000000-mapping.dmp
-
memory/6904-695-0x0000000000000000-mapping.dmp
-
memory/6908-794-0x0000000000000000-mapping.dmp
-
memory/6912-795-0x0000000000000000-mapping.dmp
-
memory/6916-608-0x0000000000000000-mapping.dmp
-
memory/6920-805-0x0000000000000000-mapping.dmp
-
memory/6924-766-0x0000000000000000-mapping.dmp
-
memory/6928-785-0x0000000000000000-mapping.dmp
-
memory/6932-696-0x0000000000000000-mapping.dmp
-
memory/6936-609-0x0000000000000000-mapping.dmp
-
memory/6940-813-0x0000000000000000-mapping.dmp
-
memory/6944-674-0x0000000000000000-mapping.dmp
-
memory/6952-814-0x0000000000000000-mapping.dmp
-
memory/6956-610-0x0000000000000000-mapping.dmp
-
memory/6960-798-0x0000000000000000-mapping.dmp
-
memory/6964-717-0x0000000000000000-mapping.dmp
-
memory/6968-721-0x0000000000000000-mapping.dmp
-
memory/6972-697-0x0000000000000000-mapping.dmp
-
memory/6976-675-0x0000000000000000-mapping.dmp
-
memory/6980-738-0x0000000000000000-mapping.dmp
-
memory/6988-801-0x0000000000000000-mapping.dmp
-
memory/6992-647-0x0000000000000000-mapping.dmp
-
memory/6996-773-0x0000000000000000-mapping.dmp
-
memory/7000-701-0x0000000000000000-mapping.dmp
-
memory/7004-611-0x0000000000000000-mapping.dmp
-
memory/7008-830-0x0000000000000000-mapping.dmp
-
memory/7012-645-0x0000000000000000-mapping.dmp
-
memory/7016-718-0x0000000000000000-mapping.dmp
-
memory/7020-612-0x0000000000000000-mapping.dmp
-
memory/7024-678-0x0000000000000000-mapping.dmp
-
memory/7028-822-0x0000000000000000-mapping.dmp
-
memory/7032-646-0x0000000000000000-mapping.dmp
-
memory/7036-786-0x0000000000000000-mapping.dmp
-
memory/7040-613-0x0000000000000000-mapping.dmp
-
memory/7044-787-0x0000000000000000-mapping.dmp
-
memory/7048-757-0x0000000000000000-mapping.dmp
-
memory/7052-706-0x0000000000000000-mapping.dmp
-
memory/7056-726-0x0000000000000000-mapping.dmp
-
memory/7060-614-0x0000000000000000-mapping.dmp
-
memory/7064-723-0x0000000000000000-mapping.dmp
-
memory/7068-699-0x0000000000000000-mapping.dmp
-
memory/7076-722-0x0000000000000000-mapping.dmp
-
memory/7080-724-0x0000000000000000-mapping.dmp
-
memory/7084-725-0x0000000000000000-mapping.dmp
-
memory/7088-802-0x0000000000000000-mapping.dmp
-
memory/7092-803-0x0000000000000000-mapping.dmp
-
memory/7096-681-0x0000000000000000-mapping.dmp
-
memory/7100-807-0x0000000000000000-mapping.dmp
-
memory/7104-682-0x0000000000000000-mapping.dmp
-
memory/7108-615-0x0000000000000000-mapping.dmp
-
memory/7112-764-0x0000000000000000-mapping.dmp
-
memory/7116-648-0x0000000000000000-mapping.dmp
-
memory/7120-676-0x0000000000000000-mapping.dmp
-
memory/7124-808-0x0000000000000000-mapping.dmp
-
memory/7128-616-0x0000000000000000-mapping.dmp
-
memory/7132-751-0x0000000000000000-mapping.dmp
-
memory/7136-804-0x0000000000000000-mapping.dmp
-
memory/7140-720-0x0000000000000000-mapping.dmp
-
memory/7144-649-0x0000000000000000-mapping.dmp
-
memory/7148-617-0x0000000000000000-mapping.dmp
-
memory/7152-650-0x0000000000000000-mapping.dmp
-
memory/7156-677-0x0000000000000000-mapping.dmp
-
memory/7160-704-0x0000000000000000-mapping.dmp
-
memory/7164-700-0x0000000000000000-mapping.dmp
-
memory/7176-834-0x0000000000000000-mapping.dmp
-
memory/7224-835-0x0000000000000000-mapping.dmp
-
memory/7244-836-0x0000000000000000-mapping.dmp
-
memory/7264-837-0x0000000000000000-mapping.dmp