Analysis
-
max time kernel
156s -
max time network
172s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-08-2020 12:30
General
-
Target
foo/383497fda5ca670a06dc688443c2011b.exe
Score
10/10
Malware Config
Signatures
-
Matrix Ransomware 5 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Executes dropped EXE 1 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\383497fda5ca670a06dc688443c2011b.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe"C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exe" -n2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"%ProgramFiles%\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v README /t REG_SZ /d "\"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe\" \"C:\Users\Admin\AppData\Roaming\#What_Wrong_With_Files#.rtf"" /f3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\ProgramData\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Roses.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\Content.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\Content.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\Content.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\Services\verisign.bmp""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\Services\verisign.bmp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\Services\verisign.bmp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adojavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adojavas.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adojavas.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\adovbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\adovbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\adovbs.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado20.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado20.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado20.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado21.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado21.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado21.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado25.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado25.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado25.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado26.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado26.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado26.tlb"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado27.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado27.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado27.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msado60.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msado60.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msado60.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadomd28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadomd28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadomd28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msador28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msador28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msador28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\ado\msadox28.tlb""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\ado\msadox28.tlb" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\ado\msadox28.tlb"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\en-US\wab32res.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcjavas.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcjavas.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcjavas.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\adcvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\adcvbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\adcvbs.inc"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqloledb.rll"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmd" "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui""2⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -R -A -S "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\foo\ZNInNyp5.cmdMD5
6650ce31671b194e0f941868f2f3542f
SHA1792a8fd0204ec0417f720a95a7cfd6286792d6dd
SHA256bea908f559e636b7a4a693045bb957f1f9892204fb084d7aa411986b3386899b
SHA5126eeb7a14d69b1ea6523bc7484777748f2e9f1b29be4802414a1a8806552bb1316021c977e7a3c79f8838f7a4692682ead66090d1692b2d102a91ee57a4d77b78
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exeMD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
C:\Users\Admin\AppData\Local\Temp\foo\n383497fda5ca670a06dc688443c2011b.exeMD5
383497fda5ca670a06dc688443c2011b
SHA1c622ebf694003368c3246e166a3a7bfc6b787652
SHA256d84d8ebcdfb0abcd821c24197517a5e329a1a6ae8e534509db78899b147cd60f
SHA5125f1f854690f9743a09fcdd0b6be43fd09af3eb5bc0f1ee4c20659458e34f46c33eec8eb651e569315902d99a12a217e5dea750411effca79485fa343c24d0129
-
C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\en-us.16\stream.x64.en-us.dbMD5
3d37ed82ee29e84e6bc8bc612c0ea952
SHA11df756665da6af091496f81b45ad7aa81eb5f6bf
SHA256456d7e0ec2dcb1491f33b71486fdabcc0bab609d05a183a22236cf35ed860ab2
SHA512189ffe611ca1721702499957c220ffae85facefcf37dd61dea233dede658cf4f966a2afff076a49f5c873248886bc13ebe0f8d35630f91b868980135bb5532e9
-
C:\Users\All Users\Microsoft\ClickToRun\ProductReleases\55E75A3F-8E75-41E5-8961-48B2B983CD6C\x-none.16\stream.x64.x-none.dbMD5
b019b3af6e7223cffa1025666ba47664
SHA1c8175b279395fdfd8be5b7fc0435994ca76dd7e4
SHA256182df96f75cba03f299d987a2403e256081c9546c33a8d4fb2f389617ee3b435
SHA512e40d37a597a76926dae16cdd40d6a3cc077f1b6d7ceb003c55f202b792ea950c7cfed9b677e116336a12870ce11dc2a423a3b2a62c5f7787aa56e927b6835087
-
memory/360-12-0x0000000000000000-mapping.dmp
-
memory/376-525-0x0000000000000000-mapping.dmp
-
memory/420-41-0x0000000000000000-mapping.dmp
-
memory/492-493-0x0000000000000000-mapping.dmp
-
memory/536-552-0x0000000000000000-mapping.dmp
-
memory/608-6-0x0000000000000000-mapping.dmp
-
memory/684-17-0x0000000000000000-mapping.dmp
-
memory/728-30-0x0000000000000000-mapping.dmp
-
memory/760-249-0x0000000000000000-mapping.dmp
-
memory/808-40-0x0000000000000000-mapping.dmp
-
memory/852-0-0x00000000024DB000-0x00000000024DC000-memory.dmpFilesize
4KB
-
memory/892-279-0x0000000000000000-mapping.dmp
-
memory/988-28-0x0000000000000000-mapping.dmp
-
memory/992-129-0x0000000000000000-mapping.dmp
-
memory/1016-44-0x0000000000000000-mapping.dmp
-
memory/1036-38-0x0000000000000000-mapping.dmp
-
memory/1072-49-0x0000000000000000-mapping.dmp
-
memory/1096-286-0x0000000000000000-mapping.dmp
-
memory/1100-441-0x0000000000000000-mapping.dmp
-
memory/1108-34-0x0000000000000000-mapping.dmp
-
memory/1136-27-0x0000000000000000-mapping.dmp
-
memory/1156-15-0x0000000000000000-mapping.dmp
-
memory/1208-51-0x0000000000000000-mapping.dmp
-
memory/1252-95-0x0000000000000000-mapping.dmp
-
memory/1356-47-0x0000000000000000-mapping.dmp
-
memory/1364-35-0x0000000000000000-mapping.dmp
-
memory/1492-217-0x0000000000000000-mapping.dmp
-
memory/1496-10-0x0000000000000000-mapping.dmp
-
memory/1828-128-0x0000000000000000-mapping.dmp
-
memory/1916-16-0x0000000000000000-mapping.dmp
-
memory/1952-37-0x0000000000000000-mapping.dmp
-
memory/1956-24-0x0000000000000000-mapping.dmp
-
memory/1988-21-0x0000000000000000-mapping.dmp
-
memory/2008-9-0x0000000000000000-mapping.dmp
-
memory/2096-36-0x0000000000000000-mapping.dmp
-
memory/2100-48-0x0000000000000000-mapping.dmp
-
memory/2120-13-0x0000000000000000-mapping.dmp
-
memory/2140-45-0x0000000000000000-mapping.dmp
-
memory/2220-179-0x0000000000000000-mapping.dmp
-
memory/2224-274-0x0000000000000000-mapping.dmp
-
memory/2260-417-0x0000000000000000-mapping.dmp
-
memory/2320-52-0x0000000000000000-mapping.dmp
-
memory/2352-26-0x0000000000000000-mapping.dmp
-
memory/2364-5-0x0000000000000000-mapping.dmp
-
memory/2388-53-0x0000000000000000-mapping.dmp
-
memory/2392-201-0x0000000000000000-mapping.dmp
-
memory/2396-54-0x0000000000000000-mapping.dmp
-
memory/2404-96-0x0000000000000000-mapping.dmp
-
memory/2420-39-0x0000000000000000-mapping.dmp
-
memory/2424-55-0x0000000000000000-mapping.dmp
-
memory/2508-183-0x0000000000000000-mapping.dmp
-
memory/2680-1-0x0000000000000000-mapping.dmp
-
memory/2680-4-0x000000000270B000-0x000000000270C000-memory.dmpFilesize
4KB
-
memory/2684-180-0x0000000000000000-mapping.dmp
-
memory/2688-19-0x0000000000000000-mapping.dmp
-
memory/2708-431-0x0000000000000000-mapping.dmp
-
memory/2712-373-0x0000000000000000-mapping.dmp
-
memory/2716-25-0x0000000000000000-mapping.dmp
-
memory/2720-29-0x0000000000000000-mapping.dmp
-
memory/2760-43-0x0000000000000000-mapping.dmp
-
memory/2888-50-0x0000000000000000-mapping.dmp
-
memory/2896-32-0x0000000000000000-mapping.dmp
-
memory/2908-11-0x0000000000000000-mapping.dmp
-
memory/2960-273-0x0000000000000000-mapping.dmp
-
memory/3200-33-0x0000000000000000-mapping.dmp
-
memory/3308-295-0x0000000000000000-mapping.dmp
-
memory/3568-214-0x0000000000000000-mapping.dmp
-
memory/3592-20-0x0000000000000000-mapping.dmp
-
memory/3604-46-0x0000000000000000-mapping.dmp
-
memory/3640-31-0x0000000000000000-mapping.dmp
-
memory/3644-7-0x0000000000000000-mapping.dmp
-
memory/3648-22-0x0000000000000000-mapping.dmp
-
memory/3748-56-0x0000000000000000-mapping.dmp
-
memory/3824-14-0x0000000000000000-mapping.dmp
-
memory/3940-42-0x0000000000000000-mapping.dmp
-
memory/4100-222-0x0000000000000000-mapping.dmp
-
memory/4104-155-0x0000000000000000-mapping.dmp
-
memory/4108-57-0x0000000000000000-mapping.dmp
-
memory/4112-240-0x0000000000000000-mapping.dmp
-
memory/4116-311-0x0000000000000000-mapping.dmp
-
memory/4120-285-0x0000000000000000-mapping.dmp
-
memory/4124-203-0x0000000000000000-mapping.dmp
-
memory/4128-58-0x0000000000000000-mapping.dmp
-
memory/4132-99-0x0000000000000000-mapping.dmp
-
memory/4136-156-0x0000000000000000-mapping.dmp
-
memory/4140-221-0x0000000000000000-mapping.dmp
-
memory/4144-97-0x0000000000000000-mapping.dmp
-
memory/4148-185-0x0000000000000000-mapping.dmp
-
memory/4152-261-0x0000000000000000-mapping.dmp
-
memory/4156-134-0x0000000000000000-mapping.dmp
-
memory/4160-205-0x0000000000000000-mapping.dmp
-
memory/4164-131-0x0000000000000000-mapping.dmp
-
memory/4168-160-0x0000000000000000-mapping.dmp
-
memory/4172-165-0x0000000000000000-mapping.dmp
-
memory/4176-59-0x0000000000000000-mapping.dmp
-
memory/4180-316-0x0000000000000000-mapping.dmp
-
memory/4184-315-0x0000000000000000-mapping.dmp
-
memory/4188-130-0x0000000000000000-mapping.dmp
-
memory/4192-292-0x0000000000000000-mapping.dmp
-
memory/4196-60-0x0000000000000000-mapping.dmp
-
memory/4200-253-0x0000000000000000-mapping.dmp
-
memory/4204-98-0x0000000000000000-mapping.dmp
-
memory/4208-161-0x0000000000000000-mapping.dmp
-
memory/4212-224-0x0000000000000000-mapping.dmp
-
memory/4216-61-0x0000000000000000-mapping.dmp
-
memory/4220-162-0x0000000000000000-mapping.dmp
-
memory/4224-235-0x0000000000000000-mapping.dmp
-
memory/4228-206-0x0000000000000000-mapping.dmp
-
memory/4232-226-0x0000000000000000-mapping.dmp
-
memory/4236-62-0x0000000000000000-mapping.dmp
-
memory/4240-137-0x0000000000000000-mapping.dmp
-
memory/4244-100-0x0000000000000000-mapping.dmp
-
memory/4248-103-0x0000000000000000-mapping.dmp
-
memory/4252-204-0x0000000000000000-mapping.dmp
-
memory/4256-207-0x0000000000000000-mapping.dmp
-
memory/4260-284-0x0000000000000000-mapping.dmp
-
memory/4264-243-0x0000000000000000-mapping.dmp
-
memory/4268-223-0x0000000000000000-mapping.dmp
-
memory/4272-163-0x0000000000000000-mapping.dmp
-
memory/4276-280-0x0000000000000000-mapping.dmp
-
memory/4280-138-0x0000000000000000-mapping.dmp
-
memory/4284-63-0x0000000000000000-mapping.dmp
-
memory/4288-101-0x0000000000000000-mapping.dmp
-
memory/4292-301-0x0000000000000000-mapping.dmp
-
memory/4296-132-0x0000000000000000-mapping.dmp
-
memory/4300-281-0x0000000000000000-mapping.dmp
-
memory/4304-64-0x0000000000000000-mapping.dmp
-
memory/4308-290-0x0000000000000000-mapping.dmp
-
memory/4312-133-0x0000000000000000-mapping.dmp
-
memory/4316-304-0x0000000000000000-mapping.dmp
-
memory/4320-159-0x0000000000000000-mapping.dmp
-
memory/4324-65-0x0000000000000000-mapping.dmp
-
memory/4328-254-0x0000000000000000-mapping.dmp
-
memory/4332-102-0x0000000000000000-mapping.dmp
-
memory/4336-238-0x0000000000000000-mapping.dmp
-
memory/4340-251-0x0000000000000000-mapping.dmp
-
memory/4344-66-0x0000000000000000-mapping.dmp
-
memory/4348-275-0x0000000000000000-mapping.dmp
-
memory/4352-357-0x0000000000000000-mapping.dmp
-
memory/4356-256-0x0000000000000000-mapping.dmp
-
memory/4360-164-0x0000000000000000-mapping.dmp
-
memory/4364-140-0x0000000000000000-mapping.dmp
-
memory/4368-192-0x0000000000000000-mapping.dmp
-
memory/4372-106-0x0000000000000000-mapping.dmp
-
memory/4376-317-0x0000000000000000-mapping.dmp
-
memory/4380-230-0x0000000000000000-mapping.dmp
-
memory/4384-283-0x0000000000000000-mapping.dmp
-
memory/4388-306-0x0000000000000000-mapping.dmp
-
memory/4392-67-0x0000000000000000-mapping.dmp
-
memory/4396-288-0x0000000000000000-mapping.dmp
-
memory/4400-225-0x0000000000000000-mapping.dmp
-
memory/4404-104-0x0000000000000000-mapping.dmp
-
memory/4408-209-0x0000000000000000-mapping.dmp
-
memory/4412-68-0x0000000000000000-mapping.dmp
-
memory/4416-307-0x0000000000000000-mapping.dmp
-
memory/4420-135-0x0000000000000000-mapping.dmp
-
memory/4424-105-0x0000000000000000-mapping.dmp
-
memory/4428-291-0x0000000000000000-mapping.dmp
-
memory/4432-69-0x0000000000000000-mapping.dmp
-
memory/4436-188-0x0000000000000000-mapping.dmp
-
memory/4440-257-0x0000000000000000-mapping.dmp
-
memory/4444-136-0x0000000000000000-mapping.dmp
-
memory/4448-186-0x0000000000000000-mapping.dmp
-
memory/4452-70-0x0000000000000000-mapping.dmp
-
memory/4456-169-0x0000000000000000-mapping.dmp
-
memory/4460-141-0x0000000000000000-mapping.dmp
-
memory/4464-293-0x0000000000000000-mapping.dmp
-
memory/4468-189-0x0000000000000000-mapping.dmp
-
memory/4472-227-0x0000000000000000-mapping.dmp
-
memory/4476-462-0x0000000000000000-mapping.dmp
-
memory/4480-308-0x0000000000000000-mapping.dmp
-
memory/4484-110-0x0000000000000000-mapping.dmp
-
memory/4488-314-0x0000000000000000-mapping.dmp
-
memory/4492-166-0x0000000000000000-mapping.dmp
-
memory/4496-139-0x0000000000000000-mapping.dmp
-
memory/4500-71-0x0000000000000000-mapping.dmp
-
memory/4504-297-0x0000000000000000-mapping.dmp
-
memory/4508-260-0x0000000000000000-mapping.dmp
-
memory/4512-168-0x0000000000000000-mapping.dmp
-
memory/4516-107-0x0000000000000000-mapping.dmp
-
memory/4520-72-0x0000000000000000-mapping.dmp
-
memory/4524-190-0x0000000000000000-mapping.dmp
-
memory/4528-356-0x0000000000000000-mapping.dmp
-
memory/4532-167-0x0000000000000000-mapping.dmp
-
memory/4536-108-0x0000000000000000-mapping.dmp
-
memory/4540-191-0x0000000000000000-mapping.dmp
-
memory/4544-73-0x0000000000000000-mapping.dmp
-
memory/4548-109-0x0000000000000000-mapping.dmp
-
memory/4552-208-0x0000000000000000-mapping.dmp
-
memory/4556-187-0x0000000000000000-mapping.dmp
-
memory/4560-266-0x0000000000000000-mapping.dmp
-
memory/4564-74-0x0000000000000000-mapping.dmp
-
memory/4568-573-0x0000000000000000-mapping.dmp
-
memory/4572-144-0x0000000000000000-mapping.dmp
-
memory/4576-147-0x0000000000000000-mapping.dmp
-
memory/4580-143-0x0000000000000000-mapping.dmp
-
memory/4584-114-0x0000000000000000-mapping.dmp
-
memory/4588-215-0x0000000000000000-mapping.dmp
-
memory/4592-278-0x0000000000000000-mapping.dmp
-
memory/4596-195-0x0000000000000000-mapping.dmp
-
memory/4600-171-0x0000000000000000-mapping.dmp
-
memory/4604-113-0x0000000000000000-mapping.dmp
-
memory/4608-193-0x0000000000000000-mapping.dmp
-
memory/4612-75-0x0000000000000000-mapping.dmp
-
memory/4616-510-0x0000000000000000-mapping.dmp
-
memory/4620-212-0x0000000000000000-mapping.dmp
-
memory/4624-210-0x0000000000000000-mapping.dmp
-
memory/4628-170-0x0000000000000000-mapping.dmp
-
memory/4632-76-0x0000000000000000-mapping.dmp
-
memory/4636-142-0x0000000000000000-mapping.dmp
-
memory/4640-111-0x0000000000000000-mapping.dmp
-
memory/4644-241-0x0000000000000000-mapping.dmp
-
memory/4648-312-0x0000000000000000-mapping.dmp
-
memory/4652-77-0x0000000000000000-mapping.dmp
-
memory/4656-245-0x0000000000000000-mapping.dmp
-
memory/4660-619-0x0000000000000000-mapping.dmp
-
memory/4664-213-0x0000000000000000-mapping.dmp
-
memory/4668-112-0x0000000000000000-mapping.dmp
-
memory/4672-78-0x0000000000000000-mapping.dmp
-
memory/4676-211-0x0000000000000000-mapping.dmp
-
memory/4680-232-0x0000000000000000-mapping.dmp
-
memory/4684-229-0x0000000000000000-mapping.dmp
-
memory/4688-289-0x0000000000000000-mapping.dmp
-
memory/4692-259-0x0000000000000000-mapping.dmp
-
memory/4696-268-0x0000000000000000-mapping.dmp
-
memory/4700-252-0x0000000000000000-mapping.dmp
-
memory/4704-303-0x0000000000000000-mapping.dmp
-
memory/4708-117-0x0000000000000000-mapping.dmp
-
memory/4712-146-0x0000000000000000-mapping.dmp
-
memory/4716-116-0x0000000000000000-mapping.dmp
-
memory/4720-79-0x0000000000000000-mapping.dmp
-
memory/4724-269-0x0000000000000000-mapping.dmp
-
memory/4728-145-0x0000000000000000-mapping.dmp
-
memory/4732-194-0x0000000000000000-mapping.dmp
-
memory/4736-219-0x0000000000000000-mapping.dmp
-
memory/4740-80-0x0000000000000000-mapping.dmp
-
memory/4744-231-0x0000000000000000-mapping.dmp
-
memory/4748-313-0x0000000000000000-mapping.dmp
-
memory/4752-461-0x0000000000000000-mapping.dmp
-
memory/4756-172-0x0000000000000000-mapping.dmp
-
memory/4760-81-0x0000000000000000-mapping.dmp
-
memory/4764-298-0x0000000000000000-mapping.dmp
-
memory/4768-115-0x0000000000000000-mapping.dmp
-
memory/4772-242-0x0000000000000000-mapping.dmp
-
memory/4776-264-0x0000000000000000-mapping.dmp
-
memory/4780-82-0x0000000000000000-mapping.dmp
-
memory/4784-120-0x0000000000000000-mapping.dmp
-
memory/4788-299-0x0000000000000000-mapping.dmp
-
memory/4792-216-0x0000000000000000-mapping.dmp
-
memory/4796-118-0x0000000000000000-mapping.dmp
-
memory/4800-276-0x0000000000000000-mapping.dmp
-
memory/4804-247-0x0000000000000000-mapping.dmp
-
memory/4808-270-0x0000000000000000-mapping.dmp
-
memory/4812-149-0x0000000000000000-mapping.dmp
-
memory/4816-174-0x0000000000000000-mapping.dmp
-
memory/4820-173-0x0000000000000000-mapping.dmp
-
memory/4824-262-0x0000000000000000-mapping.dmp
-
memory/4828-83-0x0000000000000000-mapping.dmp
-
memory/4832-148-0x0000000000000000-mapping.dmp
-
memory/4836-300-0x0000000000000000-mapping.dmp
-
memory/4840-228-0x0000000000000000-mapping.dmp
-
memory/4844-151-0x0000000000000000-mapping.dmp
-
memory/4848-84-0x0000000000000000-mapping.dmp
-
memory/4852-287-0x0000000000000000-mapping.dmp
-
memory/4856-178-0x0000000000000000-mapping.dmp
-
memory/4860-175-0x0000000000000000-mapping.dmp
-
memory/4864-282-0x0000000000000000-mapping.dmp
-
memory/4868-85-0x0000000000000000-mapping.dmp
-
memory/4872-271-0x0000000000000000-mapping.dmp
-
memory/4876-416-0x0000000000000000-mapping.dmp
-
memory/4880-119-0x0000000000000000-mapping.dmp
-
memory/4884-199-0x0000000000000000-mapping.dmp
-
memory/4888-86-0x0000000000000000-mapping.dmp
-
memory/4892-196-0x0000000000000000-mapping.dmp
-
memory/4896-121-0x0000000000000000-mapping.dmp
-
memory/4900-124-0x0000000000000000-mapping.dmp
-
memory/4904-263-0x0000000000000000-mapping.dmp
-
memory/4908-355-0x0000000000000000-mapping.dmp
-
memory/4912-267-0x0000000000000000-mapping.dmp
-
memory/4916-154-0x0000000000000000-mapping.dmp
-
memory/4920-123-0x0000000000000000-mapping.dmp
-
memory/4924-152-0x0000000000000000-mapping.dmp
-
memory/4928-202-0x0000000000000000-mapping.dmp
-
memory/4932-182-0x0000000000000000-mapping.dmp
-
memory/4936-87-0x0000000000000000-mapping.dmp
-
memory/4940-296-0x0000000000000000-mapping.dmp
-
memory/4944-150-0x0000000000000000-mapping.dmp
-
memory/4948-294-0x0000000000000000-mapping.dmp
-
memory/4952-122-0x0000000000000000-mapping.dmp
-
memory/4956-88-0x0000000000000000-mapping.dmp
-
memory/4960-181-0x0000000000000000-mapping.dmp
-
memory/4964-302-0x0000000000000000-mapping.dmp
-
memory/4968-255-0x0000000000000000-mapping.dmp
-
memory/4972-389-0x0000000000000000-mapping.dmp
-
memory/4976-89-0x0000000000000000-mapping.dmp
-
memory/4980-236-0x0000000000000000-mapping.dmp
-
memory/4984-234-0x0000000000000000-mapping.dmp
-
memory/4988-265-0x0000000000000000-mapping.dmp
-
memory/4992-305-0x0000000000000000-mapping.dmp
-
memory/4996-90-0x0000000000000000-mapping.dmp
-
memory/5000-220-0x0000000000000000-mapping.dmp
-
memory/5004-233-0x0000000000000000-mapping.dmp
-
memory/5008-248-0x0000000000000000-mapping.dmp
-
memory/5012-176-0x0000000000000000-mapping.dmp
-
memory/5016-127-0x0000000000000000-mapping.dmp
-
memory/5020-277-0x0000000000000000-mapping.dmp
-
memory/5024-158-0x0000000000000000-mapping.dmp
-
memory/5028-244-0x0000000000000000-mapping.dmp
-
memory/5032-157-0x0000000000000000-mapping.dmp
-
memory/5036-218-0x0000000000000000-mapping.dmp
-
memory/5040-310-0x0000000000000000-mapping.dmp
-
memory/5044-91-0x0000000000000000-mapping.dmp
-
memory/5048-197-0x0000000000000000-mapping.dmp
-
memory/5052-246-0x0000000000000000-mapping.dmp
-
memory/5056-125-0x0000000000000000-mapping.dmp
-
memory/5060-177-0x0000000000000000-mapping.dmp
-
memory/5064-92-0x0000000000000000-mapping.dmp
-
memory/5068-126-0x0000000000000000-mapping.dmp
-
memory/5072-153-0x0000000000000000-mapping.dmp
-
memory/5076-309-0x0000000000000000-mapping.dmp
-
memory/5080-198-0x0000000000000000-mapping.dmp
-
memory/5084-93-0x0000000000000000-mapping.dmp
-
memory/5088-272-0x0000000000000000-mapping.dmp
-
memory/5092-200-0x0000000000000000-mapping.dmp
-
memory/5096-250-0x0000000000000000-mapping.dmp
-
memory/5100-237-0x0000000000000000-mapping.dmp
-
memory/5104-94-0x0000000000000000-mapping.dmp
-
memory/5108-184-0x0000000000000000-mapping.dmp
-
memory/5112-258-0x0000000000000000-mapping.dmp
-
memory/5116-239-0x0000000000000000-mapping.dmp
-
memory/5124-450-0x0000000000000000-mapping.dmp
-
memory/5128-318-0x0000000000000000-mapping.dmp
-
memory/5132-572-0x0000000000000000-mapping.dmp
-
memory/5136-498-0x0000000000000000-mapping.dmp
-
memory/5140-464-0x0000000000000000-mapping.dmp
-
memory/5144-529-0x0000000000000000-mapping.dmp
-
memory/5148-360-0x0000000000000000-mapping.dmp
-
memory/5152-465-0x0000000000000000-mapping.dmp
-
memory/5156-470-0x0000000000000000-mapping.dmp
-
memory/5160-359-0x0000000000000000-mapping.dmp
-
memory/5164-392-0x0000000000000000-mapping.dmp
-
memory/5168-419-0x0000000000000000-mapping.dmp
-
memory/5172-508-0x0000000000000000-mapping.dmp
-
memory/5176-319-0x0000000000000000-mapping.dmp
-
memory/5180-358-0x0000000000000000-mapping.dmp
-
memory/5184-467-0x0000000000000000-mapping.dmp
-
memory/5188-390-0x0000000000000000-mapping.dmp
-
memory/5192-482-0x0000000000000000-mapping.dmp
-
memory/5196-320-0x0000000000000000-mapping.dmp
-
memory/5200-448-0x0000000000000000-mapping.dmp
-
memory/5204-391-0x0000000000000000-mapping.dmp
-
memory/5208-443-0x0000000000000000-mapping.dmp
-
memory/5212-504-0x0000000000000000-mapping.dmp
-
memory/5216-321-0x0000000000000000-mapping.dmp
-
memory/5220-425-0x0000000000000000-mapping.dmp
-
memory/5224-523-0x0000000000000000-mapping.dmp
-
memory/5228-468-0x0000000000000000-mapping.dmp
-
memory/5232-394-0x0000000000000000-mapping.dmp
-
memory/5236-322-0x0000000000000000-mapping.dmp
-
memory/5240-740-0x0000000000000000-mapping.dmp
-
memory/5244-420-0x0000000000000000-mapping.dmp
-
memory/5248-447-0x0000000000000000-mapping.dmp
-
memory/5252-522-0x0000000000000000-mapping.dmp
-
memory/5256-566-0x0000000000000000-mapping.dmp
-
memory/5260-424-0x0000000000000000-mapping.dmp
-
memory/5264-398-0x0000000000000000-mapping.dmp
-
memory/5268-486-0x0000000000000000-mapping.dmp
-
memory/5272-363-0x0000000000000000-mapping.dmp
-
memory/5276-469-0x0000000000000000-mapping.dmp
-
memory/5280-397-0x0000000000000000-mapping.dmp
-
memory/5284-323-0x0000000000000000-mapping.dmp
-
memory/5288-361-0x0000000000000000-mapping.dmp
-
memory/5292-501-0x0000000000000000-mapping.dmp
-
memory/5296-519-0x0000000000000000-mapping.dmp
-
memory/5300-393-0x0000000000000000-mapping.dmp
-
memory/5304-324-0x0000000000000000-mapping.dmp
-
memory/5308-362-0x0000000000000000-mapping.dmp
-
memory/5312-444-0x0000000000000000-mapping.dmp
-
memory/5316-526-0x0000000000000000-mapping.dmp
-
memory/5320-620-0x0000000000000000-mapping.dmp
-
memory/5324-325-0x0000000000000000-mapping.dmp
-
memory/5328-514-0x0000000000000000-mapping.dmp
-
memory/5332-557-0x0000000000000000-mapping.dmp
-
memory/5336-426-0x0000000000000000-mapping.dmp
-
memory/5340-429-0x0000000000000000-mapping.dmp
-
memory/5344-326-0x0000000000000000-mapping.dmp
-
memory/5348-427-0x0000000000000000-mapping.dmp
-
memory/5352-395-0x0000000000000000-mapping.dmp
-
memory/5356-518-0x0000000000000000-mapping.dmp
-
memory/5360-528-0x0000000000000000-mapping.dmp
-
memory/5364-777-0x0000000000000000-mapping.dmp
-
memory/5368-452-0x0000000000000000-mapping.dmp
-
memory/5372-551-0x0000000000000000-mapping.dmp
-
memory/5376-558-0x0000000000000000-mapping.dmp
-
memory/5380-490-0x0000000000000000-mapping.dmp
-
memory/5384-564-0x0000000000000000-mapping.dmp
-
memory/5388-741-0x0000000000000000-mapping.dmp
-
memory/5392-327-0x0000000000000000-mapping.dmp
-
memory/5396-535-0x0000000000000000-mapping.dmp
-
memory/5400-364-0x0000000000000000-mapping.dmp
-
memory/5404-499-0x0000000000000000-mapping.dmp
-
memory/5408-396-0x0000000000000000-mapping.dmp
-
memory/5412-328-0x0000000000000000-mapping.dmp
-
memory/5416-576-0x0000000000000000-mapping.dmp
-
memory/5420-449-0x0000000000000000-mapping.dmp
-
memory/5424-423-0x0000000000000000-mapping.dmp
-
memory/5428-365-0x0000000000000000-mapping.dmp
-
memory/5432-329-0x0000000000000000-mapping.dmp
-
memory/5436-366-0x0000000000000000-mapping.dmp
-
memory/5440-484-0x0000000000000000-mapping.dmp
-
memory/5444-401-0x0000000000000000-mapping.dmp
-
memory/5448-540-0x0000000000000000-mapping.dmp
-
memory/5452-330-0x0000000000000000-mapping.dmp
-
memory/5456-402-0x0000000000000000-mapping.dmp
-
memory/5460-471-0x0000000000000000-mapping.dmp
-
memory/5464-513-0x0000000000000000-mapping.dmp
-
memory/5468-367-0x0000000000000000-mapping.dmp
-
memory/5472-548-0x0000000000000000-mapping.dmp
-
memory/5476-405-0x0000000000000000-mapping.dmp
-
memory/5480-400-0x0000000000000000-mapping.dmp
-
memory/5484-370-0x0000000000000000-mapping.dmp
-
memory/5488-578-0x0000000000000000-mapping.dmp
-
memory/5492-494-0x0000000000000000-mapping.dmp
-
memory/5496-487-0x0000000000000000-mapping.dmp
-
memory/5500-331-0x0000000000000000-mapping.dmp
-
memory/5504-527-0x0000000000000000-mapping.dmp
-
memory/5508-489-0x0000000000000000-mapping.dmp
-
memory/5512-571-0x0000000000000000-mapping.dmp
-
memory/5516-568-0x0000000000000000-mapping.dmp
-
memory/5520-332-0x0000000000000000-mapping.dmp
-
memory/5524-399-0x0000000000000000-mapping.dmp
-
memory/5528-368-0x0000000000000000-mapping.dmp
-
memory/5532-428-0x0000000000000000-mapping.dmp
-
memory/5536-502-0x0000000000000000-mapping.dmp
-
memory/5540-333-0x0000000000000000-mapping.dmp
-
memory/5544-453-0x0000000000000000-mapping.dmp
-
memory/5548-543-0x0000000000000000-mapping.dmp
-
memory/5552-473-0x0000000000000000-mapping.dmp
-
memory/5556-369-0x0000000000000000-mapping.dmp
-
memory/5560-334-0x0000000000000000-mapping.dmp
-
memory/5564-374-0x0000000000000000-mapping.dmp
-
memory/5568-531-0x0000000000000000-mapping.dmp
-
memory/5572-533-0x0000000000000000-mapping.dmp
-
memory/5576-404-0x0000000000000000-mapping.dmp
-
memory/5580-509-0x0000000000000000-mapping.dmp
-
memory/5584-433-0x0000000000000000-mapping.dmp
-
memory/5588-403-0x0000000000000000-mapping.dmp
-
memory/5592-451-0x0000000000000000-mapping.dmp
-
memory/5596-542-0x0000000000000000-mapping.dmp
-
memory/5600-520-0x0000000000000000-mapping.dmp
-
memory/5604-455-0x0000000000000000-mapping.dmp
-
memory/5608-335-0x0000000000000000-mapping.dmp
-
memory/5612-569-0x0000000000000000-mapping.dmp
-
memory/5616-472-0x0000000000000000-mapping.dmp
-
memory/5620-430-0x0000000000000000-mapping.dmp
-
memory/5624-371-0x0000000000000000-mapping.dmp
-
memory/5628-336-0x0000000000000000-mapping.dmp
-
memory/5632-432-0x0000000000000000-mapping.dmp
-
memory/5636-516-0x0000000000000000-mapping.dmp
-
memory/5640-488-0x0000000000000000-mapping.dmp
-
memory/5644-545-0x0000000000000000-mapping.dmp
-
memory/5648-337-0x0000000000000000-mapping.dmp
-
memory/5652-474-0x0000000000000000-mapping.dmp
-
memory/5656-372-0x0000000000000000-mapping.dmp
-
memory/5660-454-0x0000000000000000-mapping.dmp
-
memory/5664-505-0x0000000000000000-mapping.dmp
-
memory/5668-338-0x0000000000000000-mapping.dmp
-
memory/5672-377-0x0000000000000000-mapping.dmp
-
memory/5676-538-0x0000000000000000-mapping.dmp
-
memory/5680-378-0x0000000000000000-mapping.dmp
-
memory/5684-779-0x0000000000000000-mapping.dmp
-
memory/5688-496-0x0000000000000000-mapping.dmp
-
memory/5692-575-0x0000000000000000-mapping.dmp
-
memory/5696-477-0x0000000000000000-mapping.dmp
-
memory/5700-459-0x0000000000000000-mapping.dmp
-
memory/5704-435-0x0000000000000000-mapping.dmp
-
memory/5708-457-0x0000000000000000-mapping.dmp
-
memory/5712-475-0x0000000000000000-mapping.dmp
-
memory/5716-339-0x0000000000000000-mapping.dmp
-
memory/5720-408-0x0000000000000000-mapping.dmp
-
memory/5724-560-0x0000000000000000-mapping.dmp
-
memory/5728-407-0x0000000000000000-mapping.dmp
-
memory/5732-507-0x0000000000000000-mapping.dmp
-
memory/5736-340-0x0000000000000000-mapping.dmp
-
memory/5740-456-0x0000000000000000-mapping.dmp
-
memory/5744-539-0x0000000000000000-mapping.dmp
-
memory/5748-479-0x0000000000000000-mapping.dmp
-
memory/5752-375-0x0000000000000000-mapping.dmp
-
memory/5756-341-0x0000000000000000-mapping.dmp
-
memory/5760-376-0x0000000000000000-mapping.dmp
-
memory/5764-406-0x0000000000000000-mapping.dmp
-
memory/5768-565-0x0000000000000000-mapping.dmp
-
memory/5772-521-0x0000000000000000-mapping.dmp
-
memory/5776-342-0x0000000000000000-mapping.dmp
-
memory/5780-506-0x0000000000000000-mapping.dmp
-
memory/5784-555-0x0000000000000000-mapping.dmp
-
memory/5788-491-0x0000000000000000-mapping.dmp
-
memory/5792-476-0x0000000000000000-mapping.dmp
-
memory/5796-381-0x0000000000000000-mapping.dmp
-
memory/5800-410-0x0000000000000000-mapping.dmp
-
memory/5804-409-0x0000000000000000-mapping.dmp
-
memory/5808-380-0x0000000000000000-mapping.dmp
-
memory/5812-478-0x0000000000000000-mapping.dmp
-
memory/5816-549-0x0000000000000000-mapping.dmp
-
memory/5820-652-0x0000000000000000-mapping.dmp
-
memory/5824-343-0x0000000000000000-mapping.dmp
-
memory/5828-434-0x0000000000000000-mapping.dmp
-
memory/5832-436-0x0000000000000000-mapping.dmp
-
memory/5836-547-0x0000000000000000-mapping.dmp
-
memory/5840-458-0x0000000000000000-mapping.dmp
-
memory/5844-344-0x0000000000000000-mapping.dmp
-
memory/5848-554-0x0000000000000000-mapping.dmp
-
memory/5852-483-0x0000000000000000-mapping.dmp
-
memory/5856-411-0x0000000000000000-mapping.dmp
-
memory/5860-567-0x0000000000000000-mapping.dmp
-
memory/5864-345-0x0000000000000000-mapping.dmp
-
memory/5868-379-0x0000000000000000-mapping.dmp
-
memory/5872-460-0x0000000000000000-mapping.dmp
-
memory/5876-570-0x0000000000000000-mapping.dmp
-
memory/5880-559-0x0000000000000000-mapping.dmp
-
memory/5884-346-0x0000000000000000-mapping.dmp
-
memory/5888-480-0x0000000000000000-mapping.dmp
-
memory/5892-574-0x0000000000000000-mapping.dmp
-
memory/5896-495-0x0000000000000000-mapping.dmp
-
memory/5900-553-0x0000000000000000-mapping.dmp
-
memory/5904-438-0x0000000000000000-mapping.dmp
-
memory/5908-561-0x0000000000000000-mapping.dmp
-
memory/5912-511-0x0000000000000000-mapping.dmp
-
memory/5916-492-0x0000000000000000-mapping.dmp
-
memory/5920-384-0x0000000000000000-mapping.dmp
-
memory/5924-412-0x0000000000000000-mapping.dmp
-
memory/5928-383-0x0000000000000000-mapping.dmp
-
memory/5932-347-0x0000000000000000-mapping.dmp
-
memory/5936-382-0x0000000000000000-mapping.dmp
-
memory/5940-439-0x0000000000000000-mapping.dmp
-
memory/5944-517-0x0000000000000000-mapping.dmp
-
memory/5948-437-0x0000000000000000-mapping.dmp
-
memory/5952-348-0x0000000000000000-mapping.dmp
-
memory/5956-463-0x0000000000000000-mapping.dmp
-
memory/5960-515-0x0000000000000000-mapping.dmp
-
memory/5964-544-0x0000000000000000-mapping.dmp
-
memory/5968-742-0x0000000000000000-mapping.dmp
-
memory/5972-349-0x0000000000000000-mapping.dmp
-
memory/5976-550-0x0000000000000000-mapping.dmp
-
memory/5980-532-0x0000000000000000-mapping.dmp
-
memory/5984-810-0x0000000000000000-mapping.dmp
-
memory/5988-556-0x0000000000000000-mapping.dmp
-
memory/5992-350-0x0000000000000000-mapping.dmp
-
memory/5996-546-0x0000000000000000-mapping.dmp
-
memory/6000-537-0x0000000000000000-mapping.dmp
-
memory/6004-497-0x0000000000000000-mapping.dmp
-
memory/6008-413-0x0000000000000000-mapping.dmp
-
memory/6012-524-0x0000000000000000-mapping.dmp
-
memory/6016-387-0x0000000000000000-mapping.dmp
-
memory/6020-562-0x0000000000000000-mapping.dmp
-
memory/6024-530-0x0000000000000000-mapping.dmp
-
memory/6028-541-0x0000000000000000-mapping.dmp
-
memory/6032-418-0x0000000000000000-mapping.dmp
-
memory/6036-446-0x0000000000000000-mapping.dmp
-
memory/6040-351-0x0000000000000000-mapping.dmp
-
memory/6044-414-0x0000000000000000-mapping.dmp
-
memory/6048-385-0x0000000000000000-mapping.dmp
-
memory/6052-481-0x0000000000000000-mapping.dmp
-
memory/6056-512-0x0000000000000000-mapping.dmp
-
memory/6060-352-0x0000000000000000-mapping.dmp
-
memory/6064-442-0x0000000000000000-mapping.dmp
-
memory/6068-500-0x0000000000000000-mapping.dmp
-
memory/6072-503-0x0000000000000000-mapping.dmp
-
memory/6076-386-0x0000000000000000-mapping.dmp
-
memory/6080-353-0x0000000000000000-mapping.dmp
-
memory/6084-563-0x0000000000000000-mapping.dmp
-
memory/6088-536-0x0000000000000000-mapping.dmp
-
memory/6092-466-0x0000000000000000-mapping.dmp
-
memory/6096-415-0x0000000000000000-mapping.dmp
-
memory/6100-354-0x0000000000000000-mapping.dmp
-
memory/6104-421-0x0000000000000000-mapping.dmp
-
memory/6108-440-0x0000000000000000-mapping.dmp
-
memory/6112-705-0x0000000000000000-mapping.dmp
-
memory/6116-388-0x0000000000000000-mapping.dmp
-
memory/6120-445-0x0000000000000000-mapping.dmp
-
memory/6124-534-0x0000000000000000-mapping.dmp
-
memory/6128-577-0x0000000000000000-mapping.dmp
-
memory/6132-422-0x0000000000000000-mapping.dmp
-
memory/6136-485-0x0000000000000000-mapping.dmp
-
memory/6140-579-0x0000000000000000-mapping.dmp
-
memory/6148-618-0x0000000000000000-mapping.dmp
-
memory/6152-758-0x0000000000000000-mapping.dmp
-
memory/6156-768-0x0000000000000000-mapping.dmp
-
memory/6160-580-0x0000000000000000-mapping.dmp
-
memory/6164-703-0x0000000000000000-mapping.dmp
-
memory/6168-651-0x0000000000000000-mapping.dmp
-
memory/6172-707-0x0000000000000000-mapping.dmp
-
memory/6176-685-0x0000000000000000-mapping.dmp
-
memory/6180-581-0x0000000000000000-mapping.dmp
-
memory/6184-783-0x0000000000000000-mapping.dmp
-
memory/6188-654-0x0000000000000000-mapping.dmp
-
memory/6192-759-0x0000000000000000-mapping.dmp
-
memory/6196-729-0x0000000000000000-mapping.dmp
-
memory/6200-582-0x0000000000000000-mapping.dmp
-
memory/6204-623-0x0000000000000000-mapping.dmp
-
memory/6208-828-0x0000000000000000-mapping.dmp
-
memory/6212-655-0x0000000000000000-mapping.dmp
-
memory/6216-621-0x0000000000000000-mapping.dmp
-
memory/6220-763-0x0000000000000000-mapping.dmp
-
memory/6224-832-0x0000000000000000-mapping.dmp
-
memory/6228-781-0x0000000000000000-mapping.dmp
-
memory/6236-820-0x0000000000000000-mapping.dmp
-
memory/6240-657-0x0000000000000000-mapping.dmp
-
memory/6244-658-0x0000000000000000-mapping.dmp
-
memory/6248-583-0x0000000000000000-mapping.dmp
-
memory/6252-679-0x0000000000000000-mapping.dmp
-
memory/6256-680-0x0000000000000000-mapping.dmp
-
memory/6260-653-0x0000000000000000-mapping.dmp
-
memory/6264-760-0x0000000000000000-mapping.dmp
-
memory/6268-584-0x0000000000000000-mapping.dmp
-
memory/6272-799-0x0000000000000000-mapping.dmp
-
memory/6276-622-0x0000000000000000-mapping.dmp
-
memory/6280-744-0x0000000000000000-mapping.dmp
-
memory/6284-745-0x0000000000000000-mapping.dmp
-
memory/6288-585-0x0000000000000000-mapping.dmp
-
memory/6292-683-0x0000000000000000-mapping.dmp
-
memory/6296-684-0x0000000000000000-mapping.dmp
-
memory/6300-708-0x0000000000000000-mapping.dmp
-
memory/6304-823-0x0000000000000000-mapping.dmp
-
memory/6308-586-0x0000000000000000-mapping.dmp
-
memory/6312-660-0x0000000000000000-mapping.dmp
-
memory/6316-624-0x0000000000000000-mapping.dmp
-
memory/6320-627-0x0000000000000000-mapping.dmp
-
memory/6324-727-0x0000000000000000-mapping.dmp
-
memory/6328-712-0x0000000000000000-mapping.dmp
-
memory/6332-821-0x0000000000000000-mapping.dmp
-
memory/6336-816-0x0000000000000000-mapping.dmp
-
memory/6340-811-0x0000000000000000-mapping.dmp
-
memory/6344-791-0x0000000000000000-mapping.dmp
-
memory/6348-661-0x0000000000000000-mapping.dmp
-
memory/6356-587-0x0000000000000000-mapping.dmp
-
memory/6360-625-0x0000000000000000-mapping.dmp
-
memory/6364-743-0x0000000000000000-mapping.dmp
-
memory/6372-709-0x0000000000000000-mapping.dmp
-
memory/6376-588-0x0000000000000000-mapping.dmp
-
memory/6380-774-0x0000000000000000-mapping.dmp
-
memory/6384-746-0x0000000000000000-mapping.dmp
-
memory/6388-769-0x0000000000000000-mapping.dmp
-
memory/6392-656-0x0000000000000000-mapping.dmp
-
memory/6396-589-0x0000000000000000-mapping.dmp
-
memory/6400-733-0x0000000000000000-mapping.dmp
-
memory/6404-626-0x0000000000000000-mapping.dmp
-
memory/6412-728-0x0000000000000000-mapping.dmp
-
memory/6416-590-0x0000000000000000-mapping.dmp
-
memory/6420-662-0x0000000000000000-mapping.dmp
-
memory/6424-761-0x0000000000000000-mapping.dmp
-
memory/6428-732-0x0000000000000000-mapping.dmp
-
memory/6436-689-0x0000000000000000-mapping.dmp
-
memory/6440-827-0x0000000000000000-mapping.dmp
-
memory/6444-664-0x0000000000000000-mapping.dmp
-
memory/6452-750-0x0000000000000000-mapping.dmp
-
memory/6456-690-0x0000000000000000-mapping.dmp
-
memory/6460-630-0x0000000000000000-mapping.dmp
-
memory/6464-591-0x0000000000000000-mapping.dmp
-
memory/6468-659-0x0000000000000000-mapping.dmp
-
memory/6472-711-0x0000000000000000-mapping.dmp
-
memory/6476-628-0x0000000000000000-mapping.dmp
-
memory/6480-730-0x0000000000000000-mapping.dmp
-
memory/6484-592-0x0000000000000000-mapping.dmp
-
memory/6488-629-0x0000000000000000-mapping.dmp
-
memory/6492-688-0x0000000000000000-mapping.dmp
-
memory/6496-710-0x0000000000000000-mapping.dmp
-
memory/6500-687-0x0000000000000000-mapping.dmp
-
memory/6504-593-0x0000000000000000-mapping.dmp
-
memory/6508-686-0x0000000000000000-mapping.dmp
-
memory/6512-782-0x0000000000000000-mapping.dmp
-
memory/6520-792-0x0000000000000000-mapping.dmp
-
memory/6524-594-0x0000000000000000-mapping.dmp
-
memory/6528-634-0x0000000000000000-mapping.dmp
-
memory/6532-793-0x0000000000000000-mapping.dmp
-
memory/6536-772-0x0000000000000000-mapping.dmp
-
memory/6540-776-0x0000000000000000-mapping.dmp
-
memory/6544-668-0x0000000000000000-mapping.dmp
-
memory/6548-796-0x0000000000000000-mapping.dmp
-
memory/6552-825-0x0000000000000000-mapping.dmp
-
memory/6556-663-0x0000000000000000-mapping.dmp
-
memory/6560-665-0x0000000000000000-mapping.dmp
-
memory/6564-752-0x0000000000000000-mapping.dmp
-
memory/6568-731-0x0000000000000000-mapping.dmp
-
memory/6572-595-0x0000000000000000-mapping.dmp
-
memory/6576-631-0x0000000000000000-mapping.dmp
-
memory/6580-817-0x0000000000000000-mapping.dmp
-
memory/6584-815-0x0000000000000000-mapping.dmp
-
memory/6588-735-0x0000000000000000-mapping.dmp
-
memory/6592-596-0x0000000000000000-mapping.dmp
-
memory/6596-765-0x0000000000000000-mapping.dmp
-
memory/6600-749-0x0000000000000000-mapping.dmp
-
memory/6604-632-0x0000000000000000-mapping.dmp
-
memory/6608-771-0x0000000000000000-mapping.dmp
-
memory/6612-597-0x0000000000000000-mapping.dmp
-
memory/6616-691-0x0000000000000000-mapping.dmp
-
memory/6620-713-0x0000000000000000-mapping.dmp
-
memory/6624-633-0x0000000000000000-mapping.dmp
-
memory/6628-788-0x0000000000000000-mapping.dmp
-
memory/6632-598-0x0000000000000000-mapping.dmp
-
memory/6636-767-0x0000000000000000-mapping.dmp
-
memory/6640-797-0x0000000000000000-mapping.dmp
-
memory/6644-638-0x0000000000000000-mapping.dmp
-
memory/6648-806-0x0000000000000000-mapping.dmp
-
memory/6652-770-0x0000000000000000-mapping.dmp
-
memory/6656-755-0x0000000000000000-mapping.dmp
-
memory/6660-754-0x0000000000000000-mapping.dmp
-
memory/6664-637-0x0000000000000000-mapping.dmp
-
memory/6668-778-0x0000000000000000-mapping.dmp
-
memory/6672-747-0x0000000000000000-mapping.dmp
-
memory/6676-789-0x0000000000000000-mapping.dmp
-
memory/6680-599-0x0000000000000000-mapping.dmp
-
memory/6684-824-0x0000000000000000-mapping.dmp
-
memory/6688-739-0x0000000000000000-mapping.dmp
-
memory/6692-714-0x0000000000000000-mapping.dmp
-
memory/6696-667-0x0000000000000000-mapping.dmp
-
memory/6700-600-0x0000000000000000-mapping.dmp
-
memory/6704-734-0x0000000000000000-mapping.dmp
-
memory/6708-716-0x0000000000000000-mapping.dmp
-
memory/6712-666-0x0000000000000000-mapping.dmp
-
memory/6716-635-0x0000000000000000-mapping.dmp
-
memory/6720-601-0x0000000000000000-mapping.dmp
-
memory/6724-636-0x0000000000000000-mapping.dmp
-
memory/6728-818-0x0000000000000000-mapping.dmp
-
memory/6732-692-0x0000000000000000-mapping.dmp
-
memory/6736-715-0x0000000000000000-mapping.dmp
-
memory/6740-602-0x0000000000000000-mapping.dmp
-
memory/6744-694-0x0000000000000000-mapping.dmp
-
memory/6748-831-0x0000000000000000-mapping.dmp
-
memory/6752-812-0x0000000000000000-mapping.dmp
-
memory/6756-780-0x0000000000000000-mapping.dmp
-
memory/6760-762-0x0000000000000000-mapping.dmp
-
memory/6764-748-0x0000000000000000-mapping.dmp
-
memory/6768-669-0x0000000000000000-mapping.dmp
-
memory/6772-641-0x0000000000000000-mapping.dmp
-
memory/6776-670-0x0000000000000000-mapping.dmp
-
memory/6780-640-0x0000000000000000-mapping.dmp
-
memory/6784-756-0x0000000000000000-mapping.dmp
-
memory/6788-603-0x0000000000000000-mapping.dmp
-
memory/6792-693-0x0000000000000000-mapping.dmp
-
memory/6796-826-0x0000000000000000-mapping.dmp
-
memory/6800-719-0x0000000000000000-mapping.dmp
-
memory/6804-819-0x0000000000000000-mapping.dmp
-
memory/6808-604-0x0000000000000000-mapping.dmp
-
memory/6812-800-0x0000000000000000-mapping.dmp
-
memory/6816-790-0x0000000000000000-mapping.dmp
-
memory/6820-698-0x0000000000000000-mapping.dmp
-
memory/6824-671-0x0000000000000000-mapping.dmp
-
memory/6828-605-0x0000000000000000-mapping.dmp
-
memory/6832-736-0x0000000000000000-mapping.dmp
-
memory/6836-809-0x0000000000000000-mapping.dmp
-
memory/6844-639-0x0000000000000000-mapping.dmp
-
memory/6848-606-0x0000000000000000-mapping.dmp
-
memory/6852-833-0x0000000000000000-mapping.dmp
-
memory/6856-737-0x0000000000000000-mapping.dmp
-
memory/6860-829-0x0000000000000000-mapping.dmp
-
memory/6864-784-0x0000000000000000-mapping.dmp
-
memory/6868-672-0x0000000000000000-mapping.dmp
-
memory/6872-673-0x0000000000000000-mapping.dmp
-
memory/6876-702-0x0000000000000000-mapping.dmp
-
memory/6880-753-0x0000000000000000-mapping.dmp
-
memory/6884-644-0x0000000000000000-mapping.dmp
-
memory/6888-775-0x0000000000000000-mapping.dmp
-
memory/6892-643-0x0000000000000000-mapping.dmp
-
memory/6896-607-0x0000000000000000-mapping.dmp
-
memory/6900-642-0x0000000000000000-mapping.dmp
-
memory/6904-695-0x0000000000000000-mapping.dmp
-
memory/6908-794-0x0000000000000000-mapping.dmp
-
memory/6912-795-0x0000000000000000-mapping.dmp
-
memory/6916-608-0x0000000000000000-mapping.dmp
-
memory/6920-805-0x0000000000000000-mapping.dmp
-
memory/6924-766-0x0000000000000000-mapping.dmp
-
memory/6928-785-0x0000000000000000-mapping.dmp
-
memory/6932-696-0x0000000000000000-mapping.dmp
-
memory/6936-609-0x0000000000000000-mapping.dmp
-
memory/6940-813-0x0000000000000000-mapping.dmp
-
memory/6944-674-0x0000000000000000-mapping.dmp
-
memory/6952-814-0x0000000000000000-mapping.dmp
-
memory/6956-610-0x0000000000000000-mapping.dmp
-
memory/6960-798-0x0000000000000000-mapping.dmp
-
memory/6964-717-0x0000000000000000-mapping.dmp
-
memory/6968-721-0x0000000000000000-mapping.dmp
-
memory/6972-697-0x0000000000000000-mapping.dmp
-
memory/6976-675-0x0000000000000000-mapping.dmp
-
memory/6980-738-0x0000000000000000-mapping.dmp
-
memory/6988-801-0x0000000000000000-mapping.dmp
-
memory/6992-647-0x0000000000000000-mapping.dmp
-
memory/6996-773-0x0000000000000000-mapping.dmp
-
memory/7000-701-0x0000000000000000-mapping.dmp
-
memory/7004-611-0x0000000000000000-mapping.dmp
-
memory/7008-830-0x0000000000000000-mapping.dmp
-
memory/7012-645-0x0000000000000000-mapping.dmp
-
memory/7016-718-0x0000000000000000-mapping.dmp
-
memory/7020-612-0x0000000000000000-mapping.dmp
-
memory/7024-678-0x0000000000000000-mapping.dmp
-
memory/7028-822-0x0000000000000000-mapping.dmp
-
memory/7032-646-0x0000000000000000-mapping.dmp
-
memory/7036-786-0x0000000000000000-mapping.dmp
-
memory/7040-613-0x0000000000000000-mapping.dmp
-
memory/7044-787-0x0000000000000000-mapping.dmp
-
memory/7048-757-0x0000000000000000-mapping.dmp
-
memory/7052-706-0x0000000000000000-mapping.dmp
-
memory/7056-726-0x0000000000000000-mapping.dmp
-
memory/7060-614-0x0000000000000000-mapping.dmp
-
memory/7064-723-0x0000000000000000-mapping.dmp
-
memory/7068-699-0x0000000000000000-mapping.dmp
-
memory/7076-722-0x0000000000000000-mapping.dmp
-
memory/7080-724-0x0000000000000000-mapping.dmp
-
memory/7084-725-0x0000000000000000-mapping.dmp
-
memory/7088-802-0x0000000000000000-mapping.dmp
-
memory/7092-803-0x0000000000000000-mapping.dmp
-
memory/7096-681-0x0000000000000000-mapping.dmp
-
memory/7100-807-0x0000000000000000-mapping.dmp
-
memory/7104-682-0x0000000000000000-mapping.dmp
-
memory/7108-615-0x0000000000000000-mapping.dmp
-
memory/7112-764-0x0000000000000000-mapping.dmp
-
memory/7116-648-0x0000000000000000-mapping.dmp
-
memory/7120-676-0x0000000000000000-mapping.dmp
-
memory/7124-808-0x0000000000000000-mapping.dmp
-
memory/7128-616-0x0000000000000000-mapping.dmp
-
memory/7132-751-0x0000000000000000-mapping.dmp
-
memory/7136-804-0x0000000000000000-mapping.dmp
-
memory/7140-720-0x0000000000000000-mapping.dmp
-
memory/7144-649-0x0000000000000000-mapping.dmp
-
memory/7148-617-0x0000000000000000-mapping.dmp
-
memory/7152-650-0x0000000000000000-mapping.dmp
-
memory/7156-677-0x0000000000000000-mapping.dmp
-
memory/7160-704-0x0000000000000000-mapping.dmp
-
memory/7164-700-0x0000000000000000-mapping.dmp
-
memory/7176-834-0x0000000000000000-mapping.dmp
-
memory/7224-835-0x0000000000000000-mapping.dmp
-
memory/7244-836-0x0000000000000000-mapping.dmp
-
memory/7264-837-0x0000000000000000-mapping.dmp