Analysis
-
max time kernel
156s -
max time network
172s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-08-2020 12:30
General
-
Target
foo/383497fda5ca670a06dc688443c2011b.exe
Score
10/10
Malware Config
Signatures
-
Matrix Ransomware 5 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Executes dropped EXE 1 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"%ProgramFiles%\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Content.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Content.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\Services\verisign.bmp""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Services\verisign.bmp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adojavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adojavas.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adovbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adovbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado20.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado20.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado21.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado21.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado25.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado25.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado26.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado26.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado27.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado27.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado60.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado60.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadomd28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadomd28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msador28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msador28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadox28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadox28.tlb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcjavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcjavas.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcvbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6650ce31671b194e0f941868f2f3542f
SHA1792a8fd0204ec0417f720a95a7cfd6286792d6dd
SHA256bea908f559e636b7a4a693045bb957f1f9892204fb084d7aa411986b3386899b
SHA5126eeb7a14d69b1ea6523bc7484777748f2e9f1b29be4802414a1a8806552bb1316021c977e7a3c79f8838f7a4692682ead66090d1692b2d102a91ee57a4d77b78
-
MD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
MD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
MD5
3d37ed82ee29e84e6bc8bc612c0ea952
SHA11df756665da6af091496f81b45ad7aa81eb5f6bf
SHA256456d7e0ec2dcb1491f33b71486fdabcc0bab609d05a183a22236cf35ed860ab2
SHA512189ffe611ca1721702499957c220ffae85facefcf37dd61dea233dede658cf4f966a2afff076a49f5c873248886bc13ebe0f8d35630f91b868980135bb5532e9
-
MD5
b019b3af6e7223cffa1025666ba47664
SHA1c8175b279395fdfd8be5b7fc0435994ca76dd7e4
SHA256182df96f75cba03f299d987a2403e256081c9546c33a8d4fb2f389617ee3b435
SHA512e40d37a597a76926dae16cdd40d6a3cc077f1b6d7ceb003c55f202b792ea950c7cfed9b677e116336a12870ce11dc2a423a3b2a62c5f7787aa56e927b6835087
-
-
-
-
-
-
-
-
-
-
-
Filesize
4KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
4KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-